1 /*
2 +----------------------------------------------------------------------+
3 | Zend Engine |
4 +----------------------------------------------------------------------+
5 | Copyright (c) Zend Technologies Ltd. (http://www.zend.com) |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 2.00 of the Zend license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.zend.com/license/2_00.txt. |
11 | If you did not receive a copy of the Zend license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@zend.com so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Andi Gutmans <andi@php.net> |
16 | Zeev Suraski <zeev@php.net> |
17 | Dmitry Stogov <dmitry@php.net> |
18 +----------------------------------------------------------------------+
19 */
20
21 #define ZEND_INTENSIVE_DEBUGGING 0
22
23 #include <stdio.h>
24 #include <signal.h>
25
26 #include "zend.h"
27 #include "zend_compile.h"
28 #include "zend_execute.h"
29 #include "zend_API.h"
30 #include "zend_ptr_stack.h"
31 #include "zend_constants.h"
32 #include "zend_extensions.h"
33 #include "zend_ini.h"
34 #include "zend_exceptions.h"
35 #include "zend_interfaces.h"
36 #include "zend_closures.h"
37 #include "zend_generators.h"
38 #include "zend_vm.h"
39 #include "zend_dtrace.h"
40 #include "zend_inheritance.h"
41 #include "zend_type_info.h"
42 #include "zend_smart_str.h"
43 #include "zend_observer.h"
44 #include "zend_system_id.h"
45 #include "zend_call_stack.h"
46 #include "Optimizer/zend_func_info.h"
47
48 /* Virtual current working directory support */
49 #include "zend_virtual_cwd.h"
50
51 #ifdef HAVE_GCC_GLOBAL_REGS
52 # if defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(i386)
53 # define ZEND_VM_FP_GLOBAL_REG "%esi"
54 # define ZEND_VM_IP_GLOBAL_REG "%edi"
55 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__x86_64__)
56 # define ZEND_VM_FP_GLOBAL_REG "%r14"
57 # define ZEND_VM_IP_GLOBAL_REG "%r15"
58 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
59 # define ZEND_VM_FP_GLOBAL_REG "r14"
60 # define ZEND_VM_IP_GLOBAL_REG "r15"
61 # elif defined(__IBMC__) && ZEND_GCC_VERSION >= 4002 && defined(__powerpc64__)
62 # define ZEND_VM_FP_GLOBAL_REG "r14"
63 # define ZEND_VM_IP_GLOBAL_REG "r15"
64 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
65 # define ZEND_VM_FP_GLOBAL_REG "x27"
66 # define ZEND_VM_IP_GLOBAL_REG "x28"
67 #elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__riscv) && __riscv_xlen == 64
68 # define ZEND_VM_FP_GLOBAL_REG "x18"
69 # define ZEND_VM_IP_GLOBAL_REG "x19"
70 # endif
71 #endif
72
73 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
74 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
75 register zend_execute_data* volatile execute_data __asm__(ZEND_VM_FP_GLOBAL_REG);
76 # pragma GCC diagnostic warning "-Wvolatile-register-var"
77 #endif
78
79 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
80 # define EXECUTE_DATA_D void
81 # define EXECUTE_DATA_C
82 # define EXECUTE_DATA_DC
83 # define EXECUTE_DATA_CC
84 # define NO_EXECUTE_DATA_CC
85 #else
86 # define EXECUTE_DATA_D zend_execute_data* execute_data
87 # define EXECUTE_DATA_C execute_data
88 # define EXECUTE_DATA_DC , EXECUTE_DATA_D
89 # define EXECUTE_DATA_CC , EXECUTE_DATA_C
90 # define NO_EXECUTE_DATA_CC , NULL
91 #endif
92
93 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
94 # define OPLINE_D void
95 # define OPLINE_C
96 # define OPLINE_DC
97 # define OPLINE_CC
98 #else
99 # define OPLINE_D const zend_op* opline
100 # define OPLINE_C opline
101 # define OPLINE_DC , OPLINE_D
102 # define OPLINE_CC , OPLINE_C
103 #endif
104
105 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
106 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
107 register const zend_op* volatile opline __asm__(ZEND_VM_IP_GLOBAL_REG);
108 # pragma GCC diagnostic warning "-Wvolatile-register-var"
109 #else
110 #endif
111
112 #define _CONST_CODE 0
113 #define _TMP_CODE 1
114 #define _VAR_CODE 2
115 #define _UNUSED_CODE 3
116 #define _CV_CODE 4
117
118 typedef int (ZEND_FASTCALL *incdec_t)(zval *);
119
120 #define get_zval_ptr(op_type, node, type) _get_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
121 #define get_zval_ptr_deref(op_type, node, type) _get_zval_ptr_deref(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
122 #define get_zval_ptr_undef(op_type, node, type) _get_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
123 #define get_op_data_zval_ptr_r(op_type, node) _get_op_data_zval_ptr_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
124 #define get_op_data_zval_ptr_deref_r(op_type, node) _get_op_data_zval_ptr_deref_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
125 #define get_zval_ptr_ptr(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
126 #define get_zval_ptr_ptr_undef(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
127 #define get_obj_zval_ptr(op_type, node, type) _get_obj_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
128 #define get_obj_zval_ptr_undef(op_type, node, type) _get_obj_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
129 #define get_obj_zval_ptr_ptr(op_type, node, type) _get_obj_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
130
131 #define RETURN_VALUE_USED(opline) ((opline)->result_type != IS_UNUSED)
132
ZEND_FUNCTION(pass)133 static ZEND_FUNCTION(pass)
134 {
135 }
136
137 ZEND_BEGIN_ARG_INFO_EX(zend_pass_function_arg_info, 0, 0, 0)
138 ZEND_END_ARG_INFO()
139
140 ZEND_API const zend_internal_function zend_pass_function = {
141 ZEND_INTERNAL_FUNCTION, /* type */
142 {0, 0, 0}, /* arg_flags */
143 0, /* fn_flags */
144 NULL, /* name */
145 NULL, /* scope */
146 NULL, /* prototype */
147 0, /* num_args */
148 0, /* required_num_args */
149 (zend_internal_arg_info *) zend_pass_function_arg_info + 1, /* arg_info */
150 NULL, /* attributes */
151 NULL, /* run_time_cache */
152 0, /* T */
153 ZEND_FN(pass), /* handler */
154 NULL, /* module */
155 {NULL,NULL,NULL,NULL} /* reserved */
156 };
157
158 #define FREE_VAR_PTR_AND_EXTRACT_RESULT_IF_NECESSARY(free_var) do { \
159 zval *__container_to_free = EX_VAR(free_var); \
160 if (UNEXPECTED(Z_REFCOUNTED_P(__container_to_free))) { \
161 zend_refcounted *__ref = Z_COUNTED_P(__container_to_free); \
162 if (UNEXPECTED(!GC_DELREF(__ref))) { \
163 zval *__zv = EX_VAR(opline->result.var); \
164 if (EXPECTED(Z_TYPE_P(__zv) == IS_INDIRECT)) { \
165 ZVAL_COPY(__zv, Z_INDIRECT_P(__zv)); \
166 } \
167 rc_dtor_func(__ref); \
168 } \
169 } \
170 } while (0)
171
172 #define FREE_OP(type, var) \
173 if ((type) & (IS_TMP_VAR|IS_VAR)) { \
174 zval_ptr_dtor_nogc(EX_VAR(var)); \
175 }
176
177 #define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
178
179 #define ZEND_VM_STACK_PAGE_SLOTS (16 * 1024) /* should be a power of 2 */
180
181 #define ZEND_VM_STACK_PAGE_SIZE (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))
182
183 #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
184 (((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
185 + ((page_size) - 1)) & ~((page_size) - 1))
186
zend_vm_stack_init(void)187 ZEND_API void zend_vm_stack_init(void)
188 {
189 EG(vm_stack_page_size) = ZEND_VM_STACK_PAGE_SIZE;
190 EG(vm_stack) = zend_vm_stack_new_page(ZEND_VM_STACK_PAGE_SIZE, NULL);
191 EG(vm_stack_top) = EG(vm_stack)->top;
192 EG(vm_stack_end) = EG(vm_stack)->end;
193 }
194
zend_vm_stack_init_ex(size_t page_size)195 ZEND_API void zend_vm_stack_init_ex(size_t page_size)
196 {
197 /* page_size must be a power of 2 */
198 ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
199 EG(vm_stack_page_size) = page_size;
200 EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
201 EG(vm_stack_top) = EG(vm_stack)->top;
202 EG(vm_stack_end) = EG(vm_stack)->end;
203 }
204
zend_vm_stack_destroy(void)205 ZEND_API void zend_vm_stack_destroy(void)
206 {
207 zend_vm_stack stack = EG(vm_stack);
208
209 while (stack != NULL) {
210 zend_vm_stack p = stack->prev;
211 efree(stack);
212 stack = p;
213 }
214 }
215
zend_vm_stack_extend(size_t size)216 ZEND_API void* zend_vm_stack_extend(size_t size)
217 {
218 zend_vm_stack stack;
219 void *ptr;
220
221 stack = EG(vm_stack);
222 stack->top = EG(vm_stack_top);
223 EG(vm_stack) = stack = zend_vm_stack_new_page(
224 EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
225 EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
226 stack);
227 ptr = stack->top;
228 EG(vm_stack_top) = (void*)(((char*)ptr) + size);
229 EG(vm_stack_end) = stack->end;
230 return ptr;
231 }
232
zend_get_compiled_variable_value(const zend_execute_data * execute_data,uint32_t var)233 ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, uint32_t var)
234 {
235 return EX_VAR(var);
236 }
237
zend_gcc_global_regs(void)238 ZEND_API bool zend_gcc_global_regs(void)
239 {
240 #if defined(HAVE_GCC_GLOBAL_REGS)
241 return 1;
242 #else
243 return 0;
244 #endif
245 }
246
_get_zval_ptr_tmp(uint32_t var EXECUTE_DATA_DC)247 static zend_always_inline zval *_get_zval_ptr_tmp(uint32_t var EXECUTE_DATA_DC)
248 {
249 zval *ret = EX_VAR(var);
250
251 ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
252
253 return ret;
254 }
255
_get_zval_ptr_var(uint32_t var EXECUTE_DATA_DC)256 static zend_always_inline zval *_get_zval_ptr_var(uint32_t var EXECUTE_DATA_DC)
257 {
258 zval *ret = EX_VAR(var);
259
260 return ret;
261 }
262
_get_zval_ptr_var_deref(uint32_t var EXECUTE_DATA_DC)263 static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var EXECUTE_DATA_DC)
264 {
265 zval *ret = EX_VAR(var);
266
267 ZVAL_DEREF(ret);
268 return ret;
269 }
270
zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)271 static zend_never_inline ZEND_COLD zval* zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)
272 {
273 if (EXPECTED(EG(exception) == NULL)) {
274 zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
275 zend_error(E_WARNING, "Undefined variable $%s", ZSTR_VAL(cv));
276 }
277 return &EG(uninitialized_zval);
278 }
279
_zval_undefined_op1(EXECUTE_DATA_D)280 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op1(EXECUTE_DATA_D)
281 {
282 return zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
283 }
284
_zval_undefined_op2(EXECUTE_DATA_D)285 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op2(EXECUTE_DATA_D)
286 {
287 return zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
288 }
289
290 #define ZVAL_UNDEFINED_OP1() _zval_undefined_op1(EXECUTE_DATA_C)
291 #define ZVAL_UNDEFINED_OP2() _zval_undefined_op2(EXECUTE_DATA_C)
292
_get_zval_cv_lookup(zval * ptr,uint32_t var,int type EXECUTE_DATA_DC)293 static zend_never_inline ZEND_COLD zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type EXECUTE_DATA_DC)
294 {
295 switch (type) {
296 case BP_VAR_R:
297 case BP_VAR_UNSET:
298 ptr = zval_undefined_cv(var EXECUTE_DATA_CC);
299 break;
300 case BP_VAR_IS:
301 ptr = &EG(uninitialized_zval);
302 break;
303 case BP_VAR_RW:
304 zval_undefined_cv(var EXECUTE_DATA_CC);
305 ZEND_FALLTHROUGH;
306 case BP_VAR_W:
307 ZVAL_NULL(ptr);
308 break;
309 }
310 return ptr;
311 }
312
_get_zval_ptr_cv(uint32_t var,int type EXECUTE_DATA_DC)313 static zend_always_inline zval *_get_zval_ptr_cv(uint32_t var, int type EXECUTE_DATA_DC)
314 {
315 zval *ret = EX_VAR(var);
316
317 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
318 if (type == BP_VAR_W) {
319 ZVAL_NULL(ret);
320 } else {
321 return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
322 }
323 }
324 return ret;
325 }
326
_get_zval_ptr_cv_deref(uint32_t var,int type EXECUTE_DATA_DC)327 static zend_always_inline zval *_get_zval_ptr_cv_deref(uint32_t var, int type EXECUTE_DATA_DC)
328 {
329 zval *ret = EX_VAR(var);
330
331 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
332 if (type == BP_VAR_W) {
333 ZVAL_NULL(ret);
334 return ret;
335 } else {
336 return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
337 }
338 }
339 ZVAL_DEREF(ret);
340 return ret;
341 }
342
_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)343 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
344 {
345 zval *ret = EX_VAR(var);
346
347 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
348 return zval_undefined_cv(var EXECUTE_DATA_CC);
349 }
350 return ret;
351 }
352
_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)353 static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
354 {
355 zval *ret = EX_VAR(var);
356
357 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
358 return zval_undefined_cv(var EXECUTE_DATA_CC);
359 }
360 ZVAL_DEREF(ret);
361 return ret;
362 }
363
_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)364 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)
365 {
366 zval *ret = EX_VAR(var);
367
368 return ret;
369 }
370
_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)371 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)
372 {
373 zval *ret = EX_VAR(var);
374
375 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
376 zval_undefined_cv(var EXECUTE_DATA_CC);
377 ZVAL_NULL(ret);
378 return ret;
379 }
380 return ret;
381 }
382
_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)383 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)
384 {
385 zval *ret = EX_VAR(var);
386
387 if (Z_TYPE_P(ret) == IS_UNDEF) {
388 ZVAL_NULL(ret);
389 }
390 return ret;
391 }
392
_get_zval_ptr_tmpvarcv(int op_type,znode_op node,int type EXECUTE_DATA_DC)393 static zend_always_inline zval *_get_zval_ptr_tmpvarcv(int op_type, znode_op node, int type EXECUTE_DATA_DC)
394 {
395 if (op_type & (IS_TMP_VAR|IS_VAR)) {
396 if (op_type == IS_TMP_VAR) {
397 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
398 } else {
399 ZEND_ASSERT(op_type == IS_VAR);
400 return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
401 }
402 } else {
403 ZEND_ASSERT(op_type == IS_CV);
404 return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
405 }
406 }
407
_get_zval_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)408 static zend_always_inline zval *_get_zval_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
409 {
410 if (op_type & (IS_TMP_VAR|IS_VAR)) {
411 if (!ZEND_DEBUG || op_type == IS_VAR) {
412 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
413 } else {
414 ZEND_ASSERT(op_type == IS_TMP_VAR);
415 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
416 }
417 } else {
418 if (op_type == IS_CONST) {
419 return RT_CONSTANT(opline, node);
420 } else if (op_type == IS_CV) {
421 return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
422 } else {
423 return NULL;
424 }
425 }
426 }
427
_get_op_data_zval_ptr_r(int op_type,znode_op node EXECUTE_DATA_DC OPLINE_DC)428 static zend_always_inline zval *_get_op_data_zval_ptr_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
429 {
430 if (op_type & (IS_TMP_VAR|IS_VAR)) {
431 if (!ZEND_DEBUG || op_type == IS_VAR) {
432 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
433 } else {
434 ZEND_ASSERT(op_type == IS_TMP_VAR);
435 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
436 }
437 } else {
438 if (op_type == IS_CONST) {
439 return RT_CONSTANT(opline + 1, node);
440 } else if (op_type == IS_CV) {
441 return _get_zval_ptr_cv_BP_VAR_R(node.var EXECUTE_DATA_CC);
442 } else {
443 return NULL;
444 }
445 }
446 }
447
_get_zval_ptr_deref(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)448 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_zval_ptr_deref(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
449 {
450 if (op_type & (IS_TMP_VAR|IS_VAR)) {
451 if (op_type == IS_TMP_VAR) {
452 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
453 } else {
454 ZEND_ASSERT(op_type == IS_VAR);
455 return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
456 }
457 } else {
458 if (op_type == IS_CONST) {
459 return RT_CONSTANT(opline, node);
460 } else if (op_type == IS_CV) {
461 return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
462 } else {
463 return NULL;
464 }
465 }
466 }
467
_get_op_data_zval_ptr_deref_r(int op_type,znode_op node EXECUTE_DATA_DC OPLINE_DC)468 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_op_data_zval_ptr_deref_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
469 {
470 if (op_type & (IS_TMP_VAR|IS_VAR)) {
471 if (op_type == IS_TMP_VAR) {
472 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
473 } else {
474 ZEND_ASSERT(op_type == IS_VAR);
475 return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
476 }
477 } else {
478 if (op_type == IS_CONST) {
479 return RT_CONSTANT(opline + 1, node);
480 } else if (op_type == IS_CV) {
481 return _get_zval_ptr_cv_deref_BP_VAR_R(node.var EXECUTE_DATA_CC);
482 } else {
483 return NULL;
484 }
485 }
486 }
487
_get_zval_ptr_undef(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)488 static zend_always_inline zval *_get_zval_ptr_undef(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
489 {
490 if (op_type & (IS_TMP_VAR|IS_VAR)) {
491 if (!ZEND_DEBUG || op_type == IS_VAR) {
492 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
493 } else {
494 ZEND_ASSERT(op_type == IS_TMP_VAR);
495 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
496 }
497 } else {
498 if (op_type == IS_CONST) {
499 return RT_CONSTANT(opline, node);
500 } else if (op_type == IS_CV) {
501 return EX_VAR(node.var);
502 } else {
503 return NULL;
504 }
505 }
506 }
507
_get_zval_ptr_ptr_var(uint32_t var EXECUTE_DATA_DC)508 static zend_always_inline zval *_get_zval_ptr_ptr_var(uint32_t var EXECUTE_DATA_DC)
509 {
510 zval *ret = EX_VAR(var);
511
512 if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
513 ret = Z_INDIRECT_P(ret);
514 }
515 return ret;
516 }
517
_get_zval_ptr_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC)518 static inline zval *_get_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
519 {
520 if (op_type == IS_CV) {
521 return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
522 } else /* if (op_type == IS_VAR) */ {
523 ZEND_ASSERT(op_type == IS_VAR);
524 return _get_zval_ptr_ptr_var(node.var EXECUTE_DATA_CC);
525 }
526 }
527
_get_obj_zval_ptr(int op_type,znode_op op,int type EXECUTE_DATA_DC OPLINE_DC)528 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
529 {
530 if (op_type == IS_UNUSED) {
531 return &EX(This);
532 }
533 return get_zval_ptr(op_type, op, type);
534 }
535
_get_obj_zval_ptr_undef(int op_type,znode_op op,int type EXECUTE_DATA_DC OPLINE_DC)536 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_undef(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
537 {
538 if (op_type == IS_UNUSED) {
539 return &EX(This);
540 }
541 return get_zval_ptr_undef(op_type, op, type);
542 }
543
_get_obj_zval_ptr_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC)544 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
545 {
546 if (op_type == IS_UNUSED) {
547 return &EX(This);
548 }
549 return get_zval_ptr_ptr(op_type, node, type);
550 }
551
zend_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr,zend_refcounted ** garbage_ptr)552 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr, zend_refcounted **garbage_ptr)
553 {
554 zend_reference *ref;
555
556 if (EXPECTED(!Z_ISREF_P(value_ptr))) {
557 ZVAL_NEW_REF(value_ptr, value_ptr);
558 } else if (UNEXPECTED(variable_ptr == value_ptr)) {
559 return;
560 }
561
562 ref = Z_REF_P(value_ptr);
563 GC_ADDREF(ref);
564 if (Z_REFCOUNTED_P(variable_ptr)) {
565 *garbage_ptr = Z_COUNTED_P(variable_ptr);
566 }
567 ZVAL_REF(variable_ptr, ref);
568 }
569
zend_assign_to_typed_property_reference(zend_property_info * prop_info,zval * prop,zval * value_ptr,zend_refcounted ** garbage_ptr EXECUTE_DATA_DC)570 static zend_never_inline zval* zend_assign_to_typed_property_reference(zend_property_info *prop_info, zval *prop, zval *value_ptr, zend_refcounted **garbage_ptr EXECUTE_DATA_DC)
571 {
572 if (!zend_verify_prop_assignable_by_ref(prop_info, value_ptr, EX_USES_STRICT_TYPES())) {
573 return &EG(uninitialized_zval);
574 }
575 if (Z_ISREF_P(prop)) {
576 ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(prop), prop_info);
577 }
578 zend_assign_to_variable_reference(prop, value_ptr, garbage_ptr);
579 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(prop), prop_info);
580 return prop;
581 }
582
zend_wrong_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr,zend_refcounted ** garbage_ptr OPLINE_DC EXECUTE_DATA_DC)583 static zend_never_inline ZEND_COLD zval *zend_wrong_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr, zend_refcounted **garbage_ptr OPLINE_DC EXECUTE_DATA_DC)
584 {
585 zend_error(E_NOTICE, "Only variables should be assigned by reference");
586 if (UNEXPECTED(EG(exception) != NULL)) {
587 return &EG(uninitialized_zval);
588 }
589
590 /* Use IS_TMP_VAR instead of IS_VAR to avoid ISREF check */
591 Z_TRY_ADDREF_P(value_ptr);
592 return zend_assign_to_variable_ex(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES(), garbage_ptr);
593 }
594
zend_cannot_pass_by_reference(uint32_t arg_num)595 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_cannot_pass_by_reference(uint32_t arg_num)
596 {
597 const zend_execute_data *execute_data = EG(current_execute_data);
598 zend_string *func_name = get_function_or_method_name(EX(call)->func);
599 const char *param_name = get_function_arg_name(EX(call)->func, arg_num);
600
601 zend_throw_error(NULL, "%s(): Argument #%d%s%s%s could not be passed by reference",
602 ZSTR_VAL(func_name), arg_num, param_name ? " ($" : "", param_name ? param_name : "", param_name ? ")" : ""
603 );
604
605 zend_string_release(func_name);
606 }
607
zend_throw_auto_init_in_prop_error(zend_property_info * prop)608 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_prop_error(zend_property_info *prop) {
609 zend_string *type_str = zend_type_to_string(prop->type);
610 zend_type_error(
611 "Cannot auto-initialize an array inside property %s::$%s of type %s",
612 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
613 ZSTR_VAL(type_str)
614 );
615 zend_string_release(type_str);
616 }
617
zend_throw_auto_init_in_ref_error(zend_property_info * prop)618 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_ref_error(zend_property_info *prop) {
619 zend_string *type_str = zend_type_to_string(prop->type);
620 zend_type_error(
621 "Cannot auto-initialize an array inside a reference held by property %s::$%s of type %s",
622 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
623 ZSTR_VAL(type_str)
624 );
625 zend_string_release(type_str);
626 }
627
zend_throw_access_uninit_prop_by_ref_error(zend_property_info * prop)628 static zend_never_inline ZEND_COLD void zend_throw_access_uninit_prop_by_ref_error(
629 zend_property_info *prop) {
630 zend_throw_error(NULL,
631 "Cannot access uninitialized non-nullable property %s::$%s by reference",
632 ZSTR_VAL(prop->ce->name),
633 zend_get_unmangled_property_name(prop->name));
634 }
635
636 /* this should modify object only if it's empty */
zend_throw_non_object_error(zval * object,zval * property OPLINE_DC EXECUTE_DATA_DC)637 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_throw_non_object_error(zval *object, zval *property OPLINE_DC EXECUTE_DATA_DC)
638 {
639 zend_string *tmp_property_name;
640 zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
641
642 if (opline->opcode == ZEND_PRE_INC_OBJ
643 || opline->opcode == ZEND_PRE_DEC_OBJ
644 || opline->opcode == ZEND_POST_INC_OBJ
645 || opline->opcode == ZEND_POST_DEC_OBJ) {
646 zend_throw_error(NULL,
647 "Attempt to increment/decrement property \"%s\" on %s",
648 ZSTR_VAL(property_name), zend_zval_value_name(object)
649 );
650 } else if (opline->opcode == ZEND_FETCH_OBJ_W
651 || opline->opcode == ZEND_FETCH_OBJ_RW
652 || opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG
653 || opline->opcode == ZEND_ASSIGN_OBJ_REF) {
654 zend_throw_error(NULL,
655 "Attempt to modify property \"%s\" on %s",
656 ZSTR_VAL(property_name), zend_zval_value_name(object)
657 );
658 } else {
659 zend_throw_error(NULL,
660 "Attempt to assign property \"%s\" on %s",
661 ZSTR_VAL(property_name), zend_zval_value_name(object)
662 );
663 }
664 zend_tmp_string_release(tmp_property_name);
665
666 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
667 ZVAL_NULL(EX_VAR(opline->result.var));
668 }
669 }
670
zend_verify_type_error_common(const zend_function * zf,const zend_arg_info * arg_info,zval * value,const char ** fname,const char ** fsep,const char ** fclass,zend_string ** need_msg,const char ** given_kind)671 static ZEND_COLD void zend_verify_type_error_common(
672 const zend_function *zf, const zend_arg_info *arg_info, zval *value,
673 const char **fname, const char **fsep, const char **fclass,
674 zend_string **need_msg, const char **given_kind)
675 {
676 *fname = ZSTR_VAL(zf->common.function_name);
677 if (zf->common.scope) {
678 *fsep = "::";
679 *fclass = ZSTR_VAL(zf->common.scope->name);
680 } else {
681 *fsep = "";
682 *fclass = "";
683 }
684
685 *need_msg = zend_type_to_string_resolved(arg_info->type, zf->common.scope);
686
687 if (value) {
688 *given_kind = zend_zval_value_name(value);
689 } else {
690 *given_kind = "none";
691 }
692 }
693
zend_verify_arg_error(const zend_function * zf,const zend_arg_info * arg_info,uint32_t arg_num,zval * value)694 ZEND_API ZEND_COLD void zend_verify_arg_error(
695 const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, zval *value)
696 {
697 zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
698 const char *fname, *fsep, *fclass;
699 zend_string *need_msg;
700 const char *given_msg;
701
702 zend_verify_type_error_common(
703 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
704
705 ZEND_ASSERT(zf->common.type == ZEND_USER_FUNCTION
706 && "Arginfo verification is not performed for internal functions");
707 if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
708 zend_argument_type_error(arg_num, "must be of type %s, %s given, called in %s on line %d",
709 ZSTR_VAL(need_msg), given_msg,
710 ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno
711 );
712 } else {
713 zend_argument_type_error(arg_num,
714 "must be of type %s, %s given", ZSTR_VAL(need_msg), given_msg);
715 }
716
717 zend_string_release(need_msg);
718 }
719
zend_verify_weak_scalar_type_hint(uint32_t type_mask,zval * arg)720 static bool zend_verify_weak_scalar_type_hint(uint32_t type_mask, zval *arg)
721 {
722 zend_long lval;
723 double dval;
724 zend_string *str;
725 bool bval;
726
727 /* Type preference order: int -> float -> string -> bool */
728 if (type_mask & MAY_BE_LONG) {
729 /* For an int|float union type and string value,
730 * determine chosen type by is_numeric_string() semantics. */
731 if ((type_mask & MAY_BE_DOUBLE) && Z_TYPE_P(arg) == IS_STRING) {
732 uint8_t type = is_numeric_str_function(Z_STR_P(arg), &lval, &dval);
733 if (type == IS_LONG) {
734 zend_string_release(Z_STR_P(arg));
735 ZVAL_LONG(arg, lval);
736 return 1;
737 }
738 if (type == IS_DOUBLE) {
739 zend_string_release(Z_STR_P(arg));
740 ZVAL_DOUBLE(arg, dval);
741 return 1;
742 }
743 } else if (zend_parse_arg_long_weak(arg, &lval, 0)) {
744 zval_ptr_dtor(arg);
745 ZVAL_LONG(arg, lval);
746 return 1;
747 } else if (UNEXPECTED(EG(exception))) {
748 return 0;
749 }
750 }
751 if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval, 0)) {
752 zval_ptr_dtor(arg);
753 ZVAL_DOUBLE(arg, dval);
754 return 1;
755 }
756 if ((type_mask & MAY_BE_STRING) && zend_parse_arg_str_weak(arg, &str, 0)) {
757 /* on success "arg" is converted to IS_STRING */
758 return 1;
759 }
760 if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval, 0)) {
761 zval_ptr_dtor(arg);
762 ZVAL_BOOL(arg, bval);
763 return 1;
764 }
765 return 0;
766 }
767
768 #if ZEND_DEBUG
can_convert_to_string(const zval * zv)769 static bool can_convert_to_string(const zval *zv) {
770 /* We don't call cast_object here, because this check must be side-effect free. As this
771 * is only used for a sanity check of arginfo/zpp consistency, it's okay if we accept
772 * more than actually allowed here. */
773 if (Z_TYPE_P(zv) == IS_OBJECT) {
774 return Z_OBJ_HT_P(zv)->cast_object != zend_std_cast_object_tostring
775 || Z_OBJCE_P(zv)->__tostring;
776 }
777 return Z_TYPE_P(zv) <= IS_STRING;
778 }
779
780 /* Used to sanity-check internal arginfo types without performing any actual type conversions. */
zend_verify_weak_scalar_type_hint_no_sideeffect(uint32_t type_mask,const zval * arg)781 static bool zend_verify_weak_scalar_type_hint_no_sideeffect(uint32_t type_mask, const zval *arg)
782 {
783 zend_long lval;
784 double dval;
785 bool bval;
786
787 /* Pass (uint32_t)-1 as arg_num to indicate to ZPP not to emit any deprecation notice,
788 * this is needed because the version with side effects also uses 0 (e.g. for typed properties) */
789 if ((type_mask & MAY_BE_LONG) && zend_parse_arg_long_weak(arg, &lval, (uint32_t)-1)) {
790 return 1;
791 }
792 if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval, (uint32_t)-1)) {
793 return 1;
794 }
795 if ((type_mask & MAY_BE_STRING) && can_convert_to_string(arg)) {
796 return 1;
797 }
798 if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval, (uint32_t)-1)) {
799 return 1;
800 }
801 return 0;
802 }
803 #endif
804
zend_verify_scalar_type_hint(uint32_t type_mask,zval * arg,bool strict,bool is_internal_arg)805 ZEND_API bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, bool strict, bool is_internal_arg)
806 {
807 if (UNEXPECTED(strict)) {
808 /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
809 if (!(type_mask & MAY_BE_DOUBLE) || Z_TYPE_P(arg) != IS_LONG) {
810 return 0;
811 }
812 } else if (UNEXPECTED(Z_TYPE_P(arg) == IS_NULL)) {
813 /* NULL may be accepted only by nullable hints (this is already checked).
814 * As an exception for internal functions, null is allowed for scalar types in weak mode. */
815 return is_internal_arg
816 && (type_mask & (MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING));
817 }
818 #if ZEND_DEBUG
819 if (is_internal_arg) {
820 return zend_verify_weak_scalar_type_hint_no_sideeffect(type_mask, arg);
821 }
822 #endif
823 return zend_verify_weak_scalar_type_hint(type_mask, arg);
824 }
825
zend_verify_class_constant_type_error(const zend_class_constant * c,const zend_string * name,const zval * constant)826 ZEND_COLD zend_never_inline void zend_verify_class_constant_type_error(const zend_class_constant *c, const zend_string *name, const zval *constant)
827 {
828 zend_string *type_str = zend_type_to_string(c->type);
829
830 zend_type_error("Cannot assign %s to class constant %s::%s of type %s",
831 zend_zval_type_name(constant), ZSTR_VAL(c->ce->name), ZSTR_VAL(name), ZSTR_VAL(type_str));
832
833 zend_string_release(type_str);
834 }
835
zend_verify_property_type_error(const zend_property_info * info,const zval * property)836 ZEND_COLD zend_never_inline void zend_verify_property_type_error(const zend_property_info *info, const zval *property)
837 {
838 zend_string *type_str;
839
840 /* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
841 if (EG(exception)) {
842 return;
843 }
844
845 type_str = zend_type_to_string(info->type);
846 zend_type_error("Cannot assign %s to property %s::$%s of type %s",
847 zend_zval_value_name(property),
848 ZSTR_VAL(info->ce->name),
849 zend_get_unmangled_property_name(info->name),
850 ZSTR_VAL(type_str));
851 zend_string_release(type_str);
852 }
853
zend_magic_get_property_type_inconsistency_error(const zend_property_info * info,const zval * property)854 ZEND_COLD zend_never_inline void zend_magic_get_property_type_inconsistency_error(const zend_property_info *info, const zval *property)
855 {
856 /* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
857 if (EG(exception)) {
858 return;
859 }
860
861 zend_string *type_str = zend_type_to_string(info->type);
862 zend_type_error("Value of type %s returned from %s::__get() must be compatible with unset property %s::$%s of type %s",
863 zend_zval_type_name(property),
864 ZSTR_VAL(info->ce->name),
865 ZSTR_VAL(info->ce->name),
866 zend_get_unmangled_property_name(info->name),
867 ZSTR_VAL(type_str));
868 zend_string_release(type_str);
869 }
870
zend_match_unhandled_error(const zval * value)871 ZEND_COLD void zend_match_unhandled_error(const zval *value)
872 {
873 smart_str msg = {0};
874
875 if (Z_TYPE_P(value) <= IS_STRING) {
876 smart_str_append_scalar(&msg, value, EG(exception_string_param_max_len));
877 } else {
878 smart_str_appendl(&msg, "of type ", sizeof("of type ")-1);
879 smart_str_appends(&msg, zend_zval_type_name(value));
880 }
881
882 smart_str_0(&msg);
883
884 zend_throw_exception_ex(
885 zend_ce_unhandled_match_error, 0, "Unhandled match case %s", ZSTR_VAL(msg.s));
886
887 smart_str_free(&msg);
888 }
889
zend_readonly_property_modification_error(const zend_property_info * info)890 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_modification_error(
891 const zend_property_info *info) {
892 zend_throw_error(NULL, "Cannot modify readonly property %s::$%s",
893 ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
894 }
895
zend_readonly_property_indirect_modification_error(const zend_property_info * info)896 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_indirect_modification_error(const zend_property_info *info)
897 {
898 zend_throw_error(NULL, "Cannot indirectly modify readonly property %s::$%s",
899 ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
900 }
901
zend_invalid_class_constant_type_error(uint8_t type)902 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_invalid_class_constant_type_error(uint8_t type)
903 {
904 zend_type_error("Cannot use value of type %s as class constant name", zend_get_type_by_const(type));
905 }
906
zend_object_released_while_assigning_to_property_error(const zend_property_info * info)907 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_object_released_while_assigning_to_property_error(const zend_property_info *info)
908 {
909 zend_throw_error(NULL, "Object was released while assigning to property %s::$%s",
910 ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
911 }
912
resolve_single_class_type(zend_string * name,const zend_class_entry * self_ce)913 static const zend_class_entry *resolve_single_class_type(zend_string *name, const zend_class_entry *self_ce) {
914 if (zend_string_equals_literal_ci(name, "self")) {
915 return self_ce;
916 } else if (zend_string_equals_literal_ci(name, "parent")) {
917 return self_ce->parent;
918 } else {
919 return zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
920 }
921 }
922
zend_ce_from_type(const zend_class_entry * scope,const zend_type * type)923 static zend_always_inline const zend_class_entry *zend_ce_from_type(
924 const zend_class_entry *scope, const zend_type *type) {
925 ZEND_ASSERT(ZEND_TYPE_HAS_NAME(*type));
926 zend_string *name = ZEND_TYPE_NAME(*type);
927 if (ZSTR_HAS_CE_CACHE(name)) {
928 zend_class_entry *ce = ZSTR_GET_CE_CACHE(name);
929 if (!ce) {
930 ce = zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
931 }
932 return ce;
933 }
934 return resolve_single_class_type(name, scope);
935 }
936
zend_check_intersection_for_property_or_class_constant_class_type(const zend_class_entry * scope,zend_type_list * intersection_type_list,const zend_class_entry * value_ce)937 static bool zend_check_intersection_for_property_or_class_constant_class_type(
938 const zend_class_entry *scope, zend_type_list *intersection_type_list, const zend_class_entry *value_ce)
939 {
940 zend_type *list_type;
941
942 ZEND_TYPE_LIST_FOREACH(intersection_type_list, list_type) {
943 ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
944 const zend_class_entry *ce = zend_ce_from_type(scope, list_type);
945 if (!ce || !instanceof_function(value_ce, ce)) {
946 return false;
947 }
948 } ZEND_TYPE_LIST_FOREACH_END();
949 return true;
950 }
951
zend_check_and_resolve_property_or_class_constant_class_type(const zend_class_entry * scope,zend_type member_type,const zend_class_entry * value_ce)952 static bool zend_check_and_resolve_property_or_class_constant_class_type(
953 const zend_class_entry *scope, zend_type member_type, const zend_class_entry *value_ce) {
954 if (ZEND_TYPE_HAS_LIST(member_type)) {
955 zend_type *list_type;
956 if (ZEND_TYPE_IS_INTERSECTION(member_type)) {
957 return zend_check_intersection_for_property_or_class_constant_class_type(
958 scope, ZEND_TYPE_LIST(member_type), value_ce);
959 } else {
960 ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(member_type), list_type) {
961 if (ZEND_TYPE_IS_INTERSECTION(*list_type)) {
962 if (zend_check_intersection_for_property_or_class_constant_class_type(
963 scope, ZEND_TYPE_LIST(*list_type), value_ce)) {
964 return true;
965 }
966 continue;
967 }
968 ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
969 const zend_class_entry *ce = zend_ce_from_type(scope, list_type);
970 if (ce && instanceof_function(value_ce, ce)) {
971 return true;
972 }
973 } ZEND_TYPE_LIST_FOREACH_END();
974
975 if ((ZEND_TYPE_PURE_MASK(member_type) & MAY_BE_STATIC)) {
976 return value_ce == scope;
977 }
978
979 return false;
980 }
981 } else if ((ZEND_TYPE_PURE_MASK(member_type) & MAY_BE_STATIC) && value_ce == scope) {
982 return true;
983 } else if (ZEND_TYPE_HAS_NAME(member_type)) {
984 const zend_class_entry *ce = zend_ce_from_type(scope, &member_type);
985 return ce && instanceof_function(value_ce, ce);
986 }
987
988 return false;
989 }
990
i_zend_check_property_type(const zend_property_info * info,zval * property,bool strict)991 static zend_always_inline bool i_zend_check_property_type(const zend_property_info *info, zval *property, bool strict)
992 {
993 ZEND_ASSERT(!Z_ISREF_P(property));
994 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(info->type, Z_TYPE_P(property)))) {
995 return 1;
996 }
997
998 if (ZEND_TYPE_IS_COMPLEX(info->type) && Z_TYPE_P(property) == IS_OBJECT
999 && zend_check_and_resolve_property_or_class_constant_class_type(info->ce, info->type, Z_OBJCE_P(property))) {
1000 return 1;
1001 }
1002
1003 uint32_t type_mask = ZEND_TYPE_FULL_MASK(info->type);
1004 ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC|MAY_BE_NEVER|MAY_BE_VOID)));
1005 return zend_verify_scalar_type_hint(type_mask, property, strict, 0);
1006 }
1007
i_zend_verify_property_type(const zend_property_info * info,zval * property,bool strict)1008 static zend_always_inline bool i_zend_verify_property_type(const zend_property_info *info, zval *property, bool strict)
1009 {
1010 if (i_zend_check_property_type(info, property, strict)) {
1011 return 1;
1012 }
1013
1014 zend_verify_property_type_error(info, property);
1015 return 0;
1016 }
1017
zend_verify_property_type(const zend_property_info * info,zval * property,bool strict)1018 ZEND_API bool zend_never_inline zend_verify_property_type(const zend_property_info *info, zval *property, bool strict) {
1019 return i_zend_verify_property_type(info, property, strict);
1020 }
1021
zend_assign_to_typed_prop(zend_property_info * info,zval * property_val,zval * value,zend_refcounted ** garbage_ptr EXECUTE_DATA_DC)1022 static zend_never_inline zval* zend_assign_to_typed_prop(zend_property_info *info, zval *property_val, zval *value, zend_refcounted **garbage_ptr EXECUTE_DATA_DC)
1023 {
1024 zval tmp;
1025
1026 if (UNEXPECTED((info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(property_val) & IS_PROP_REINITABLE))) {
1027 zend_readonly_property_modification_error(info);
1028 return &EG(uninitialized_zval);
1029 }
1030
1031 ZVAL_DEREF(value);
1032 ZVAL_COPY(&tmp, value);
1033
1034 if (UNEXPECTED(!i_zend_verify_property_type(info, &tmp, EX_USES_STRICT_TYPES()))) {
1035 zval_ptr_dtor(&tmp);
1036 return &EG(uninitialized_zval);
1037 }
1038
1039 Z_PROP_FLAG_P(property_val) &= ~IS_PROP_REINITABLE;
1040
1041 return zend_assign_to_variable_ex(property_val, &tmp, IS_TMP_VAR, EX_USES_STRICT_TYPES(), garbage_ptr);
1042 }
1043
zend_value_instanceof_static(zval * zv)1044 static zend_always_inline bool zend_value_instanceof_static(zval *zv) {
1045 if (Z_TYPE_P(zv) != IS_OBJECT) {
1046 return 0;
1047 }
1048
1049 zend_class_entry *called_scope = zend_get_called_scope(EG(current_execute_data));
1050 if (!called_scope) {
1051 return 0;
1052 }
1053 return instanceof_function(Z_OBJCE_P(zv), called_scope);
1054 }
1055
1056 /* The cache_slot may only be NULL in debug builds, where arginfo verification of
1057 * internal functions is enabled. Avoid unnecessary checks in release builds. */
1058 #if ZEND_DEBUG
1059 # define HAVE_CACHE_SLOT (cache_slot != NULL)
1060 #else
1061 # define HAVE_CACHE_SLOT 1
1062 #endif
1063
1064 #define PROGRESS_CACHE_SLOT() if (HAVE_CACHE_SLOT) {cache_slot++;}
1065
zend_fetch_ce_from_cache_slot(void ** cache_slot,zend_type * type)1066 static zend_always_inline zend_class_entry *zend_fetch_ce_from_cache_slot(
1067 void **cache_slot, zend_type *type)
1068 {
1069 if (EXPECTED(HAVE_CACHE_SLOT && *cache_slot)) {
1070 return (zend_class_entry *) *cache_slot;
1071 }
1072
1073 zend_string *name = ZEND_TYPE_NAME(*type);
1074 zend_class_entry *ce;
1075 if (ZSTR_HAS_CE_CACHE(name)) {
1076 ce = ZSTR_GET_CE_CACHE(name);
1077 if (!ce) {
1078 ce = zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
1079 if (UNEXPECTED(!ce)) {
1080 /* Cannot resolve */
1081 return NULL;
1082 }
1083 }
1084 } else {
1085 ce = zend_fetch_class(name,
1086 ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD | ZEND_FETCH_CLASS_SILENT);
1087 if (UNEXPECTED(!ce)) {
1088 return NULL;
1089 }
1090 }
1091 if (HAVE_CACHE_SLOT) {
1092 *cache_slot = (void *) ce;
1093 }
1094 return ce;
1095 }
1096
zend_check_intersection_type_from_cache_slot(zend_type_list * intersection_type_list,zend_class_entry * arg_ce,void *** cache_slot_ptr)1097 static bool zend_check_intersection_type_from_cache_slot(zend_type_list *intersection_type_list,
1098 zend_class_entry *arg_ce, void ***cache_slot_ptr)
1099 {
1100 void **cache_slot = *cache_slot_ptr;
1101 zend_class_entry *ce;
1102 zend_type *list_type;
1103 bool status = true;
1104 ZEND_TYPE_LIST_FOREACH(intersection_type_list, list_type) {
1105 /* Only check classes if the type might be valid */
1106 if (status) {
1107 ce = zend_fetch_ce_from_cache_slot(cache_slot, list_type);
1108 /* If type is not an instance of one of the types taking part in the
1109 * intersection it cannot be a valid instance of the whole intersection type. */
1110 if (!ce || !instanceof_function(arg_ce, ce)) {
1111 status = false;
1112 }
1113 }
1114 PROGRESS_CACHE_SLOT();
1115 } ZEND_TYPE_LIST_FOREACH_END();
1116 if (HAVE_CACHE_SLOT) {
1117 *cache_slot_ptr = cache_slot;
1118 }
1119 return status;
1120 }
1121
zend_check_type_slow(zend_type * type,zval * arg,zend_reference * ref,void ** cache_slot,bool is_return_type,bool is_internal)1122 static zend_always_inline bool zend_check_type_slow(
1123 zend_type *type, zval *arg, zend_reference *ref, void **cache_slot,
1124 bool is_return_type, bool is_internal)
1125 {
1126 uint32_t type_mask;
1127 if (ZEND_TYPE_IS_COMPLEX(*type) && EXPECTED(Z_TYPE_P(arg) == IS_OBJECT)) {
1128 zend_class_entry *ce;
1129 if (UNEXPECTED(ZEND_TYPE_HAS_LIST(*type))) {
1130 zend_type *list_type;
1131 if (ZEND_TYPE_IS_INTERSECTION(*type)) {
1132 return zend_check_intersection_type_from_cache_slot(ZEND_TYPE_LIST(*type), Z_OBJCE_P(arg), &cache_slot);
1133 } else {
1134 ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(*type), list_type) {
1135 if (ZEND_TYPE_IS_INTERSECTION(*list_type)) {
1136 if (zend_check_intersection_type_from_cache_slot(ZEND_TYPE_LIST(*list_type), Z_OBJCE_P(arg), &cache_slot)) {
1137 return true;
1138 }
1139 /* The cache_slot is progressed in zend_check_intersection_type_from_cache_slot() */
1140 } else {
1141 ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
1142 ce = zend_fetch_ce_from_cache_slot(cache_slot, list_type);
1143 /* Instance of a single type part of a union is sufficient to pass the type check */
1144 if (ce && instanceof_function(Z_OBJCE_P(arg), ce)) {
1145 return true;
1146 }
1147 PROGRESS_CACHE_SLOT();
1148 }
1149 } ZEND_TYPE_LIST_FOREACH_END();
1150 }
1151 } else {
1152 ce = zend_fetch_ce_from_cache_slot(cache_slot, type);
1153 /* If we have a CE we check if it satisfies the type constraint,
1154 * otherwise it will check if a standard type satisfies it. */
1155 if (ce && instanceof_function(Z_OBJCE_P(arg), ce)) {
1156 return true;
1157 }
1158 }
1159 }
1160
1161 type_mask = ZEND_TYPE_FULL_MASK(*type);
1162 if ((type_mask & MAY_BE_CALLABLE) &&
1163 zend_is_callable(arg, is_internal ? IS_CALLABLE_SUPPRESS_DEPRECATIONS : 0, NULL)) {
1164 return 1;
1165 }
1166 if ((type_mask & MAY_BE_STATIC) && zend_value_instanceof_static(arg)) {
1167 return 1;
1168 }
1169 if (ref && ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1170 /* We cannot have conversions for typed refs. */
1171 return 0;
1172 }
1173 if (is_internal && is_return_type) {
1174 /* For internal returns, the type has to match exactly, because we're not
1175 * going to check it for non-debug builds, and there will be no chance to
1176 * apply coercions. */
1177 return 0;
1178 }
1179
1180 return zend_verify_scalar_type_hint(type_mask, arg,
1181 is_return_type ? ZEND_RET_USES_STRICT_TYPES() : ZEND_ARG_USES_STRICT_TYPES(),
1182 is_internal);
1183
1184 /* Special handling for IS_VOID is not necessary (for return types),
1185 * because this case is already checked at compile-time. */
1186 }
1187
zend_check_type(zend_type * type,zval * arg,void ** cache_slot,zend_class_entry * scope,bool is_return_type,bool is_internal)1188 static zend_always_inline bool zend_check_type(
1189 zend_type *type, zval *arg, void **cache_slot, zend_class_entry *scope,
1190 bool is_return_type, bool is_internal)
1191 {
1192 zend_reference *ref = NULL;
1193 ZEND_ASSERT(ZEND_TYPE_IS_SET(*type));
1194
1195 if (UNEXPECTED(Z_ISREF_P(arg))) {
1196 ref = Z_REF_P(arg);
1197 arg = Z_REFVAL_P(arg);
1198 }
1199
1200 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(*type, Z_TYPE_P(arg)))) {
1201 return 1;
1202 }
1203
1204 return zend_check_type_slow(type, arg, ref, cache_slot, is_return_type, is_internal);
1205 }
1206
zend_check_user_type_slow(zend_type * type,zval * arg,zend_reference * ref,void ** cache_slot,bool is_return_type)1207 ZEND_API bool zend_check_user_type_slow(
1208 zend_type *type, zval *arg, zend_reference *ref, void **cache_slot, bool is_return_type)
1209 {
1210 return zend_check_type_slow(
1211 type, arg, ref, cache_slot, is_return_type, /* is_internal */ false);
1212 }
1213
zend_verify_recv_arg_type(zend_function * zf,uint32_t arg_num,zval * arg,void ** cache_slot)1214 static zend_always_inline bool zend_verify_recv_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, void **cache_slot)
1215 {
1216 zend_arg_info *cur_arg_info;
1217
1218 ZEND_ASSERT(arg_num <= zf->common.num_args);
1219 cur_arg_info = &zf->common.arg_info[arg_num-1];
1220
1221 if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1222 && UNEXPECTED(!zend_check_type(&cur_arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
1223 zend_verify_arg_error(zf, cur_arg_info, arg_num, arg);
1224 return 0;
1225 }
1226
1227 return 1;
1228 }
1229
zend_verify_variadic_arg_type(zend_function * zf,zend_arg_info * arg_info,uint32_t arg_num,zval * arg,void ** cache_slot)1230 static zend_always_inline bool zend_verify_variadic_arg_type(
1231 zend_function *zf, zend_arg_info *arg_info, uint32_t arg_num, zval *arg, void **cache_slot)
1232 {
1233 ZEND_ASSERT(ZEND_TYPE_IS_SET(arg_info->type));
1234 if (UNEXPECTED(!zend_check_type(&arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
1235 zend_verify_arg_error(zf, arg_info, arg_num, arg);
1236 return 0;
1237 }
1238
1239 return 1;
1240 }
1241
zend_verify_internal_arg_types(zend_function * fbc,zend_execute_data * call)1242 static zend_never_inline ZEND_ATTRIBUTE_UNUSED bool zend_verify_internal_arg_types(zend_function *fbc, zend_execute_data *call)
1243 {
1244 uint32_t i;
1245 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
1246 zval *arg = ZEND_CALL_ARG(call, 1);
1247
1248 for (i = 0; i < num_args; ++i) {
1249 zend_arg_info *cur_arg_info;
1250 if (EXPECTED(i < fbc->common.num_args)) {
1251 cur_arg_info = &fbc->common.arg_info[i];
1252 } else if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1253 cur_arg_info = &fbc->common.arg_info[fbc->common.num_args];
1254 } else {
1255 break;
1256 }
1257
1258 if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1259 && UNEXPECTED(!zend_check_type(&cur_arg_info->type, arg, /* cache_slot */ NULL, fbc->common.scope, 0, /* is_internal */ 1))) {
1260 return 0;
1261 }
1262 arg++;
1263 }
1264 return 1;
1265 }
1266
1267 #if ZEND_DEBUG
1268 /* Determine whether an internal call should throw, because the passed arguments violate
1269 * an arginfo constraint. This is only checked in debug builds. In release builds, we
1270 * trust that arginfo matches what is enforced by zend_parse_parameters. */
zend_internal_call_should_throw(zend_function * fbc,zend_execute_data * call)1271 ZEND_API bool zend_internal_call_should_throw(zend_function *fbc, zend_execute_data *call)
1272 {
1273 if (fbc->internal_function.handler == ZEND_FN(pass) || (fbc->internal_function.fn_flags & ZEND_ACC_FAKE_CLOSURE)) {
1274 /* Be lenient about the special pass function and about fake closures. */
1275 return 0;
1276 }
1277
1278 if (fbc->common.required_num_args > ZEND_CALL_NUM_ARGS(call)) {
1279 /* Required argument not passed. */
1280 return 1;
1281 }
1282
1283 if (fbc->common.num_args < ZEND_CALL_NUM_ARGS(call)
1284 && !(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1285 /* Too many arguments passed. For internal functions (unlike userland functions),
1286 * this should always throw. */
1287 return 1;
1288 }
1289
1290 if ((fbc->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) &&
1291 !zend_verify_internal_arg_types(fbc, call)) {
1292 return 1;
1293 }
1294
1295 return 0;
1296 }
1297
zend_internal_call_arginfo_violation(zend_function * fbc)1298 ZEND_API ZEND_COLD void zend_internal_call_arginfo_violation(zend_function *fbc)
1299 {
1300 zend_error(E_ERROR, "Arginfo / zpp mismatch during call of %s%s%s()",
1301 fbc->common.scope ? ZSTR_VAL(fbc->common.scope->name) : "",
1302 fbc->common.scope ? "::" : "",
1303 ZSTR_VAL(fbc->common.function_name));
1304 }
1305
1306 #ifndef ZEND_VERIFY_FUNC_INFO
1307 # define ZEND_VERIFY_FUNC_INFO 0
1308 #endif
1309
zend_verify_internal_func_info(zend_function * fn,zval * retval)1310 static void zend_verify_internal_func_info(zend_function *fn, zval *retval) {
1311 #if ZEND_VERIFY_FUNC_INFO
1312 zend_string *name = fn->common.function_name;
1313 uint32_t type_mask = zend_get_internal_func_info(fn, NULL, NULL);
1314 if (!type_mask) {
1315 return;
1316 }
1317
1318 /* Always check refcount of arrays, as immutable arrays are RCN. */
1319 if (Z_REFCOUNTED_P(retval) || Z_TYPE_P(retval) == IS_ARRAY) {
1320 if (!(type_mask & MAY_BE_RC1)) {
1321 zend_error_noreturn(E_CORE_ERROR, "%s() missing rc1", ZSTR_VAL(name));
1322 }
1323 if (Z_REFCOUNT_P(retval) > 1 && !(type_mask & MAY_BE_RCN)) {
1324 zend_error_noreturn(E_CORE_ERROR, "%s() missing rcn", ZSTR_VAL(name));
1325 }
1326 }
1327
1328 uint32_t type = 1u << Z_TYPE_P(retval);
1329 if (!(type_mask & type)) {
1330 zend_error_noreturn(E_CORE_ERROR, "%s() missing type %s",
1331 ZSTR_VAL(name), zend_get_type_by_const(Z_TYPE_P(retval)));
1332 }
1333
1334 if (Z_TYPE_P(retval) == IS_ARRAY) {
1335 HashTable *ht = Z_ARRVAL_P(retval);
1336 uint32_t num_checked = 0;
1337 zend_string *str;
1338 zval *val;
1339 ZEND_HASH_FOREACH_STR_KEY_VAL(ht, str, val) {
1340 if (str) {
1341 if (!(type_mask & MAY_BE_ARRAY_KEY_STRING)) {
1342 zend_error_noreturn(E_CORE_ERROR,
1343 "%s() missing array_key_string", ZSTR_VAL(name));
1344 }
1345 } else {
1346 if (!(type_mask & MAY_BE_ARRAY_KEY_LONG)) {
1347 zend_error_noreturn(E_CORE_ERROR,
1348 "%s() missing array_key_long", ZSTR_VAL(name));
1349 }
1350 }
1351
1352 uint32_t array_type = 1u << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
1353 if (!(type_mask & array_type)) {
1354 zend_error_noreturn(E_CORE_ERROR,
1355 "%s() missing array element type %s",
1356 ZSTR_VAL(name), zend_get_type_by_const(Z_TYPE_P(retval)));
1357 }
1358
1359 /* Don't check all elements of large arrays. */
1360 if (++num_checked > 16) {
1361 break;
1362 }
1363 } ZEND_HASH_FOREACH_END();
1364 }
1365 #endif
1366 }
1367 #endif
1368
zend_missing_arg_error(zend_execute_data * execute_data)1369 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *execute_data)
1370 {
1371 zend_execute_data *ptr = EX(prev_execute_data);
1372
1373 if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
1374 zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
1375 EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1376 EX(func)->common.scope ? "::" : "",
1377 ZSTR_VAL(EX(func)->common.function_name),
1378 EX_NUM_ARGS(),
1379 ZSTR_VAL(ptr->func->op_array.filename),
1380 ptr->opline->lineno,
1381 EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1382 EX(func)->common.required_num_args);
1383 } else {
1384 zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
1385 EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1386 EX(func)->common.scope ? "::" : "",
1387 ZSTR_VAL(EX(func)->common.function_name),
1388 EX_NUM_ARGS(),
1389 EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1390 EX(func)->common.required_num_args);
1391 }
1392 }
1393
zend_verify_return_error(const zend_function * zf,zval * value)1394 ZEND_API ZEND_COLD void zend_verify_return_error(const zend_function *zf, zval *value)
1395 {
1396 const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1397 const char *fname, *fsep, *fclass;
1398 zend_string *need_msg;
1399 const char *given_msg;
1400
1401 zend_verify_type_error_common(
1402 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1403
1404 zend_type_error("%s%s%s(): Return value must be of type %s, %s returned",
1405 fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1406
1407 zend_string_release(need_msg);
1408 }
1409
zend_verify_never_error(const zend_function * zf)1410 ZEND_API ZEND_COLD void zend_verify_never_error(const zend_function *zf)
1411 {
1412 zend_string *func_name = get_function_or_method_name(zf);
1413
1414 zend_type_error("%s(): never-returning function must not implicitly return",
1415 ZSTR_VAL(func_name));
1416
1417 zend_string_release(func_name);
1418 }
1419
1420 #if ZEND_DEBUG
zend_verify_internal_return_error(const zend_function * zf,zval * value)1421 static ZEND_COLD void zend_verify_internal_return_error(const zend_function *zf, zval *value)
1422 {
1423 const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1424 const char *fname, *fsep, *fclass;
1425 zend_string *need_msg;
1426 const char *given_msg;
1427
1428 zend_verify_type_error_common(
1429 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1430
1431 zend_error_noreturn(E_CORE_ERROR, "%s%s%s(): Return value must be of type %s, %s returned",
1432 fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1433 }
1434
zend_verify_void_return_error(const zend_function * zf,const char * returned_msg,const char * returned_kind)1435 static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, const char *returned_msg, const char *returned_kind)
1436 {
1437 const char *fname = ZSTR_VAL(zf->common.function_name);
1438 const char *fsep;
1439 const char *fclass;
1440
1441 if (zf->common.scope) {
1442 fsep = "::";
1443 fclass = ZSTR_VAL(zf->common.scope->name);
1444 } else {
1445 fsep = "";
1446 fclass = "";
1447 }
1448
1449 zend_type_error("%s%s%s() must not return a value, %s%s returned",
1450 fclass, fsep, fname, returned_msg, returned_kind);
1451 }
1452
zend_verify_internal_return_type(zend_function * zf,zval * ret)1453 ZEND_API bool zend_verify_internal_return_type(zend_function *zf, zval *ret)
1454 {
1455 zend_internal_arg_info *ret_info = zf->internal_function.arg_info - 1;
1456
1457 if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_VOID) {
1458 if (UNEXPECTED(Z_TYPE_P(ret) != IS_NULL)) {
1459 zend_verify_void_return_error(zf, zend_zval_value_name(ret), "");
1460 return 0;
1461 }
1462 return 1;
1463 }
1464
1465 if (UNEXPECTED(!zend_check_type(&ret_info->type, ret, /* cache_slot */ NULL, NULL, 1, /* is_internal */ 1))) {
1466 zend_verify_internal_return_error(zf, ret);
1467 return 0;
1468 }
1469
1470 return 1;
1471 }
1472 #endif
1473
zend_verify_missing_return_type(const zend_function * zf)1474 static ZEND_COLD void zend_verify_missing_return_type(const zend_function *zf)
1475 {
1476 /* VERIFY_RETURN_TYPE is not emitted for "void" functions, so this is always an error. */
1477 zend_verify_return_error(zf, NULL);
1478 }
1479
zend_check_class_constant_type(zend_class_constant * c,zval * constant)1480 static zend_always_inline bool zend_check_class_constant_type(zend_class_constant *c, zval *constant)
1481 {
1482 ZEND_ASSERT(!Z_ISREF_P(constant));
1483 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(c->type, Z_TYPE_P(constant)))) {
1484 return 1;
1485 }
1486
1487 if (((ZEND_TYPE_PURE_MASK(c->type) & MAY_BE_STATIC) || ZEND_TYPE_IS_COMPLEX(c->type)) && Z_TYPE_P(constant) == IS_OBJECT
1488 && zend_check_and_resolve_property_or_class_constant_class_type(c->ce, c->type, Z_OBJCE_P(constant))) {
1489 return 1;
1490 }
1491
1492 uint32_t type_mask = ZEND_TYPE_FULL_MASK(c->type);
1493 ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_NEVER|MAY_BE_VOID)));
1494 return zend_verify_scalar_type_hint(type_mask, constant, true, false);
1495 }
1496
zend_verify_class_constant_type(zend_class_constant * c,const zend_string * name,zval * constant)1497 ZEND_API bool zend_never_inline zend_verify_class_constant_type(zend_class_constant *c, const zend_string *name, zval *constant)
1498 {
1499 if (!zend_check_class_constant_type(c, constant)) {
1500 zend_verify_class_constant_type_error(c, name, constant);
1501 return 0;
1502 }
1503
1504 return 1;
1505 }
1506
zend_use_object_as_array(const zend_object * object)1507 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_object_as_array(const zend_object *object)
1508 {
1509 zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(object->ce->name));
1510 }
1511
zend_illegal_array_offset_access(const zval * offset)1512 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_access(const zval *offset)
1513 {
1514 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_RW);
1515 }
1516
zend_illegal_array_offset_isset(const zval * offset)1517 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_isset(const zval *offset)
1518 {
1519 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_IS);
1520 }
1521
zend_illegal_array_offset_unset(const zval * offset)1522 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_unset(const zval *offset)
1523 {
1524 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_UNSET);
1525 }
1526
zend_illegal_string_offset(const zval * offset,int type)1527 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_string_offset(const zval *offset, int type)
1528 {
1529 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_STRING), offset, type);
1530 }
1531
zend_assign_to_object_dim(zend_object * obj,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1532 static zend_never_inline void zend_assign_to_object_dim(zend_object *obj, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1533 {
1534 obj->handlers->write_dimension(obj, dim, value);
1535
1536 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1537 ZVAL_COPY(EX_VAR(opline->result.var), value);
1538 }
1539 }
1540
zend_binary_op(zval * ret,zval * op1,zval * op2 OPLINE_DC)1541 static zend_always_inline int zend_binary_op(zval *ret, zval *op1, zval *op2 OPLINE_DC)
1542 {
1543 static const binary_op_type zend_binary_ops[] = {
1544 add_function,
1545 sub_function,
1546 mul_function,
1547 div_function,
1548 mod_function,
1549 shift_left_function,
1550 shift_right_function,
1551 concat_function,
1552 bitwise_or_function,
1553 bitwise_and_function,
1554 bitwise_xor_function,
1555 pow_function
1556 };
1557 /* size_t cast makes GCC to better optimize 64-bit PIC code */
1558 size_t opcode = (size_t)opline->extended_value;
1559
1560 return zend_binary_ops[opcode - ZEND_ADD](ret, op1, op2);
1561 }
1562
zend_binary_assign_op_obj_dim(zend_object * obj,zval * property OPLINE_DC EXECUTE_DATA_DC)1563 static zend_never_inline void zend_binary_assign_op_obj_dim(zend_object *obj, zval *property OPLINE_DC EXECUTE_DATA_DC)
1564 {
1565 zval *value;
1566 zval *z;
1567 zval rv, res;
1568
1569 GC_ADDREF(obj);
1570 if (property && UNEXPECTED(Z_ISUNDEF_P(property))) {
1571 property = ZVAL_UNDEFINED_OP2();
1572 }
1573 value = get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1);
1574 if ((z = obj->handlers->read_dimension(obj, property, BP_VAR_R, &rv)) != NULL) {
1575
1576 if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1577 obj->handlers->write_dimension(obj, property, &res);
1578 }
1579 if (z == &rv) {
1580 zval_ptr_dtor(&rv);
1581 }
1582 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1583 ZVAL_COPY(EX_VAR(opline->result.var), &res);
1584 }
1585 zval_ptr_dtor(&res);
1586 } else {
1587 zend_use_object_as_array(obj);
1588 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1589 ZVAL_NULL(EX_VAR(opline->result.var));
1590 }
1591 }
1592 FREE_OP((opline+1)->op1_type, (opline+1)->op1.var);
1593 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1594 zend_objects_store_del(obj);
1595 }
1596 }
1597
zend_binary_assign_op_typed_ref(zend_reference * ref,zval * value OPLINE_DC EXECUTE_DATA_DC)1598 static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *ref, zval *value OPLINE_DC EXECUTE_DATA_DC)
1599 {
1600 zval z_copy;
1601
1602 /* Make sure that in-place concatenation is used if the LHS is a string. */
1603 if (opline->extended_value == ZEND_CONCAT && Z_TYPE(ref->val) == IS_STRING) {
1604 concat_function(&ref->val, &ref->val, value);
1605 ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
1606 return;
1607 }
1608
1609 zend_binary_op(&z_copy, &ref->val, value OPLINE_CC);
1610 if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, EX_USES_STRICT_TYPES()))) {
1611 zval_ptr_dtor(&ref->val);
1612 ZVAL_COPY_VALUE(&ref->val, &z_copy);
1613 } else {
1614 zval_ptr_dtor(&z_copy);
1615 }
1616 }
1617
zend_binary_assign_op_typed_prop(zend_property_info * prop_info,zval * zptr,zval * value OPLINE_DC EXECUTE_DATA_DC)1618 static zend_never_inline void zend_binary_assign_op_typed_prop(zend_property_info *prop_info, zval *zptr, zval *value OPLINE_DC EXECUTE_DATA_DC)
1619 {
1620 zval z_copy;
1621
1622 /* Make sure that in-place concatenation is used if the LHS is a string. */
1623 if (opline->extended_value == ZEND_CONCAT && Z_TYPE_P(zptr) == IS_STRING) {
1624 concat_function(zptr, zptr, value);
1625 ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
1626 return;
1627 }
1628
1629 zend_binary_op(&z_copy, zptr, value OPLINE_CC);
1630 if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
1631 zval_ptr_dtor(zptr);
1632 ZVAL_COPY_VALUE(zptr, &z_copy);
1633 } else {
1634 zval_ptr_dtor(&z_copy);
1635 }
1636 }
1637
zend_check_string_offset(zval * dim,int type EXECUTE_DATA_DC)1638 static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type EXECUTE_DATA_DC)
1639 {
1640 zend_long offset;
1641
1642 try_again:
1643 switch(Z_TYPE_P(dim)) {
1644 case IS_LONG:
1645 return Z_LVAL_P(dim);
1646 case IS_STRING:
1647 {
1648 bool trailing_data = false;
1649 /* For BC reasons we allow errors so that we can warn on leading numeric string */
1650 if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset, NULL,
1651 /* allow errors */ true, NULL, &trailing_data)) {
1652 if (UNEXPECTED(trailing_data) && type != BP_VAR_UNSET) {
1653 zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
1654 }
1655 return offset;
1656 }
1657 zend_illegal_string_offset(dim, type);
1658 return 0;
1659 }
1660 case IS_UNDEF:
1661 ZVAL_UNDEFINED_OP2();
1662 ZEND_FALLTHROUGH;
1663 case IS_DOUBLE:
1664 case IS_NULL:
1665 case IS_FALSE:
1666 case IS_TRUE:
1667 zend_error(E_WARNING, "String offset cast occurred");
1668 break;
1669 case IS_REFERENCE:
1670 dim = Z_REFVAL_P(dim);
1671 goto try_again;
1672 default:
1673 zend_illegal_string_offset(dim, type);
1674 return 0;
1675 }
1676
1677 return zval_get_long_func(dim, /* is_strict */ false);
1678 }
1679
zend_wrong_string_offset_error(void)1680 ZEND_API ZEND_COLD void zend_wrong_string_offset_error(void)
1681 {
1682 const char *msg = NULL;
1683 const zend_execute_data *execute_data = EG(current_execute_data);
1684 const zend_op *opline = execute_data->opline;
1685
1686 if (UNEXPECTED(EG(exception) != NULL)) {
1687 return;
1688 }
1689
1690 switch (opline->opcode) {
1691 case ZEND_ASSIGN_DIM_OP:
1692 msg = "Cannot use assign-op operators with string offsets";
1693 break;
1694 case ZEND_FETCH_LIST_W:
1695 msg = "Cannot create references to/from string offsets";
1696 break;
1697 case ZEND_FETCH_DIM_W:
1698 case ZEND_FETCH_DIM_RW:
1699 case ZEND_FETCH_DIM_FUNC_ARG:
1700 case ZEND_FETCH_DIM_UNSET:
1701 switch (opline->extended_value) {
1702 case ZEND_FETCH_DIM_REF:
1703 msg = "Cannot create references to/from string offsets";
1704 break;
1705 case ZEND_FETCH_DIM_DIM:
1706 msg = "Cannot use string offset as an array";
1707 break;
1708 case ZEND_FETCH_DIM_OBJ:
1709 msg = "Cannot use string offset as an object";
1710 break;
1711 case ZEND_FETCH_DIM_INCDEC:
1712 msg = "Cannot increment/decrement string offsets";
1713 break;
1714 EMPTY_SWITCH_DEFAULT_CASE();
1715 }
1716 break;
1717 EMPTY_SWITCH_DEFAULT_CASE();
1718 }
1719 ZEND_ASSERT(msg != NULL);
1720 zend_throw_error(NULL, "%s", msg);
1721 }
1722
zend_deprecated_function(const zend_function * fbc)1723 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_deprecated_function(const zend_function *fbc)
1724 {
1725 if (fbc->common.scope) {
1726 zend_error(E_DEPRECATED, "Method %s::%s() is deprecated",
1727 ZSTR_VAL(fbc->common.scope->name),
1728 ZSTR_VAL(fbc->common.function_name)
1729 );
1730 } else {
1731 zend_error(E_DEPRECATED, "Function %s() is deprecated", ZSTR_VAL(fbc->common.function_name));
1732 }
1733 }
1734
zend_false_to_array_deprecated(void)1735 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_false_to_array_deprecated(void)
1736 {
1737 zend_error(E_DEPRECATED, "Automatic conversion of false to array is deprecated");
1738 }
1739
zend_assign_to_string_offset(zval * str,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1740 static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1741 {
1742 zend_uchar c;
1743 size_t string_len;
1744 zend_long offset;
1745 zend_string *s;
1746
1747 /* separate string */
1748 if (Z_REFCOUNTED_P(str) && Z_REFCOUNT_P(str) == 1) {
1749 s = Z_STR_P(str);
1750 } else {
1751 s = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
1752 ZSTR_H(s) = ZSTR_H(Z_STR_P(str));
1753 if (Z_REFCOUNTED_P(str)) {
1754 GC_DELREF(Z_STR_P(str));
1755 }
1756 ZVAL_NEW_STR(str, s);
1757 }
1758
1759 if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1760 offset = Z_LVAL_P(dim);
1761 } else {
1762 /* The string may be destroyed while throwing the notice.
1763 * Temporarily increase the refcount to detect this situation. */
1764 GC_ADDREF(s);
1765 offset = zend_check_string_offset(dim, BP_VAR_W EXECUTE_DATA_CC);
1766 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1767 zend_string_efree(s);
1768 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1769 ZVAL_NULL(EX_VAR(opline->result.var));
1770 }
1771 return;
1772 }
1773 /* Illegal offset assignment */
1774 if (UNEXPECTED(EG(exception) != NULL)) {
1775 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1776 ZVAL_UNDEF(EX_VAR(opline->result.var));
1777 }
1778 return;
1779 }
1780 }
1781
1782 if (UNEXPECTED(offset < -(zend_long)ZSTR_LEN(s))) {
1783 /* Error on negative offset */
1784 zend_error(E_WARNING, "Illegal string offset " ZEND_LONG_FMT, offset);
1785 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1786 ZVAL_NULL(EX_VAR(opline->result.var));
1787 }
1788 return;
1789 }
1790
1791 if (offset < 0) { /* Handle negative offset */
1792 offset += (zend_long)ZSTR_LEN(s);
1793 }
1794
1795 if (UNEXPECTED(Z_TYPE_P(value) != IS_STRING)) {
1796 zend_string *tmp;
1797
1798 /* The string may be destroyed while throwing the notice.
1799 * Temporarily increase the refcount to detect this situation. */
1800 GC_ADDREF(s);
1801 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1802 zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC);
1803 }
1804 /* Convert to string, just the time to pick the 1st byte */
1805 tmp = zval_try_get_string_func(value);
1806 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1807 zend_string_efree(s);
1808 if (tmp) {
1809 zend_string_release_ex(tmp, 0);
1810 }
1811 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1812 ZVAL_NULL(EX_VAR(opline->result.var));
1813 }
1814 return;
1815 }
1816 if (UNEXPECTED(!tmp)) {
1817 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1818 ZVAL_UNDEF(EX_VAR(opline->result.var));
1819 }
1820 return;
1821 }
1822
1823 string_len = ZSTR_LEN(tmp);
1824 c = (zend_uchar)ZSTR_VAL(tmp)[0];
1825 zend_string_release_ex(tmp, 0);
1826 } else {
1827 string_len = Z_STRLEN_P(value);
1828 c = (zend_uchar)Z_STRVAL_P(value)[0];
1829 }
1830
1831 if (UNEXPECTED(string_len != 1)) {
1832 if (string_len == 0) {
1833 /* Error on empty input string */
1834 zend_throw_error(NULL, "Cannot assign an empty string to a string offset");
1835 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1836 ZVAL_NULL(EX_VAR(opline->result.var));
1837 }
1838 return;
1839 }
1840
1841 /* The string may be destroyed while throwing the notice.
1842 * Temporarily increase the refcount to detect this situation. */
1843 GC_ADDREF(s);
1844 zend_error(E_WARNING, "Only the first byte will be assigned to the string offset");
1845 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1846 zend_string_efree(s);
1847 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1848 ZVAL_NULL(EX_VAR(opline->result.var));
1849 }
1850 return;
1851 }
1852 /* Illegal offset assignment */
1853 if (UNEXPECTED(EG(exception) != NULL)) {
1854 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1855 ZVAL_UNDEF(EX_VAR(opline->result.var));
1856 }
1857 return;
1858 }
1859 }
1860
1861 if ((size_t)offset >= ZSTR_LEN(s)) {
1862 /* Extend string if needed */
1863 zend_long old_len = ZSTR_LEN(s);
1864 ZVAL_NEW_STR(str, zend_string_extend(s, (size_t)offset + 1, 0));
1865 memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
1866 Z_STRVAL_P(str)[offset+1] = 0;
1867 } else {
1868 zend_string_forget_hash_val(Z_STR_P(str));
1869 }
1870
1871 Z_STRVAL_P(str)[offset] = c;
1872
1873 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1874 /* Return the new character */
1875 ZVAL_CHAR(EX_VAR(opline->result.var), c);
1876 }
1877 }
1878
zend_get_prop_not_accepting_double(zend_reference * ref)1879 static zend_property_info *zend_get_prop_not_accepting_double(zend_reference *ref)
1880 {
1881 zend_property_info *prop;
1882 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
1883 if (!(ZEND_TYPE_FULL_MASK(prop->type) & MAY_BE_DOUBLE)) {
1884 return prop;
1885 }
1886 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
1887 return NULL;
1888 }
1889
zend_throw_incdec_ref_error(zend_reference * ref,zend_property_info * error_prop OPLINE_DC)1890 static ZEND_COLD zend_long zend_throw_incdec_ref_error(
1891 zend_reference *ref, zend_property_info *error_prop OPLINE_DC)
1892 {
1893 zend_string *type_str = zend_type_to_string(error_prop->type);
1894 if (ZEND_IS_INCREMENT(opline->opcode)) {
1895 zend_type_error(
1896 "Cannot increment a reference held by property %s::$%s of type %s past its maximal value",
1897 ZSTR_VAL(error_prop->ce->name),
1898 zend_get_unmangled_property_name(error_prop->name),
1899 ZSTR_VAL(type_str));
1900 zend_string_release(type_str);
1901 return ZEND_LONG_MAX;
1902 } else {
1903 zend_type_error(
1904 "Cannot decrement a reference held by property %s::$%s of type %s past its minimal value",
1905 ZSTR_VAL(error_prop->ce->name),
1906 zend_get_unmangled_property_name(error_prop->name),
1907 ZSTR_VAL(type_str));
1908 zend_string_release(type_str);
1909 return ZEND_LONG_MIN;
1910 }
1911 }
1912
zend_throw_incdec_prop_error(zend_property_info * prop OPLINE_DC)1913 static ZEND_COLD zend_long zend_throw_incdec_prop_error(zend_property_info *prop OPLINE_DC) {
1914 zend_string *type_str = zend_type_to_string(prop->type);
1915 if (ZEND_IS_INCREMENT(opline->opcode)) {
1916 zend_type_error("Cannot increment property %s::$%s of type %s past its maximal value",
1917 ZSTR_VAL(prop->ce->name),
1918 zend_get_unmangled_property_name(prop->name),
1919 ZSTR_VAL(type_str));
1920 zend_string_release(type_str);
1921 return ZEND_LONG_MAX;
1922 } else {
1923 zend_type_error("Cannot decrement property %s::$%s of type %s past its minimal value",
1924 ZSTR_VAL(prop->ce->name),
1925 zend_get_unmangled_property_name(prop->name),
1926 ZSTR_VAL(type_str));
1927 zend_string_release(type_str);
1928 return ZEND_LONG_MIN;
1929 }
1930 }
1931
zend_incdec_typed_ref(zend_reference * ref,zval * copy OPLINE_DC EXECUTE_DATA_DC)1932 static void zend_incdec_typed_ref(zend_reference *ref, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1933 {
1934 zval tmp;
1935 zval *var_ptr = &ref->val;
1936
1937 if (!copy) {
1938 copy = &tmp;
1939 }
1940
1941 ZVAL_COPY(copy, var_ptr);
1942
1943 if (ZEND_IS_INCREMENT(opline->opcode)) {
1944 increment_function(var_ptr);
1945 } else {
1946 decrement_function(var_ptr);
1947 }
1948
1949 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1950 zend_property_info *error_prop = zend_get_prop_not_accepting_double(ref);
1951 if (UNEXPECTED(error_prop)) {
1952 zend_long val = zend_throw_incdec_ref_error(ref, error_prop OPLINE_CC);
1953 ZVAL_LONG(var_ptr, val);
1954 }
1955 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, EX_USES_STRICT_TYPES()))) {
1956 zval_ptr_dtor(var_ptr);
1957 ZVAL_COPY_VALUE(var_ptr, copy);
1958 ZVAL_UNDEF(copy);
1959 } else if (copy == &tmp) {
1960 zval_ptr_dtor(&tmp);
1961 }
1962 }
1963
zend_incdec_typed_prop(zend_property_info * prop_info,zval * var_ptr,zval * copy OPLINE_DC EXECUTE_DATA_DC)1964 static void zend_incdec_typed_prop(zend_property_info *prop_info, zval *var_ptr, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1965 {
1966 zval tmp;
1967
1968 if (!copy) {
1969 copy = &tmp;
1970 }
1971
1972 ZVAL_COPY(copy, var_ptr);
1973
1974 if (ZEND_IS_INCREMENT(opline->opcode)) {
1975 increment_function(var_ptr);
1976 } else {
1977 decrement_function(var_ptr);
1978 }
1979
1980 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1981 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
1982 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1983 ZVAL_LONG(var_ptr, val);
1984 }
1985 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
1986 zval_ptr_dtor(var_ptr);
1987 ZVAL_COPY_VALUE(var_ptr, copy);
1988 ZVAL_UNDEF(copy);
1989 } else if (copy == &tmp) {
1990 zval_ptr_dtor(&tmp);
1991 }
1992 }
1993
zend_pre_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)1994 static void zend_pre_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
1995 {
1996 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
1997 if (ZEND_IS_INCREMENT(opline->opcode)) {
1998 fast_long_increment_function(prop);
1999 } else {
2000 fast_long_decrement_function(prop);
2001 }
2002 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)
2003 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2004 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
2005 ZVAL_LONG(prop, val);
2006 }
2007 } else {
2008 do {
2009 if (Z_ISREF_P(prop)) {
2010 zend_reference *ref = Z_REF_P(prop);
2011 prop = Z_REFVAL_P(prop);
2012 if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
2013 zend_incdec_typed_ref(ref, NULL OPLINE_CC EXECUTE_DATA_CC);
2014 break;
2015 }
2016 }
2017
2018 if (UNEXPECTED(prop_info)) {
2019 zend_incdec_typed_prop(prop_info, prop, NULL OPLINE_CC EXECUTE_DATA_CC);
2020 } else if (ZEND_IS_INCREMENT(opline->opcode)) {
2021 increment_function(prop);
2022 } else {
2023 decrement_function(prop);
2024 }
2025 } while (0);
2026 }
2027 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2028 ZVAL_COPY(EX_VAR(opline->result.var), prop);
2029 }
2030 }
2031
zend_post_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)2032 static void zend_post_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
2033 {
2034 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
2035 ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(prop));
2036 if (ZEND_IS_INCREMENT(opline->opcode)) {
2037 fast_long_increment_function(prop);
2038 } else {
2039 fast_long_decrement_function(prop);
2040 }
2041 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)
2042 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2043 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
2044 ZVAL_LONG(prop, val);
2045 }
2046 } else {
2047 if (Z_ISREF_P(prop)) {
2048 zend_reference *ref = Z_REF_P(prop);
2049 prop = Z_REFVAL_P(prop);
2050 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2051 zend_incdec_typed_ref(ref, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
2052 return;
2053 }
2054 }
2055
2056 if (UNEXPECTED(prop_info)) {
2057 zend_incdec_typed_prop(prop_info, prop, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
2058 } else {
2059 ZVAL_COPY(EX_VAR(opline->result.var), prop);
2060 if (ZEND_IS_INCREMENT(opline->opcode)) {
2061 increment_function(prop);
2062 } else {
2063 decrement_function(prop);
2064 }
2065 }
2066 }
2067 }
2068
zend_post_incdec_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)2069 static zend_never_inline void zend_post_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
2070 {
2071 zval rv;
2072 zval *z;
2073 zval z_copy;
2074
2075 GC_ADDREF(object);
2076 z =object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2077 if (UNEXPECTED(EG(exception))) {
2078 OBJ_RELEASE(object);
2079 ZVAL_UNDEF(EX_VAR(opline->result.var));
2080 return;
2081 }
2082
2083 ZVAL_COPY_DEREF(&z_copy, z);
2084 ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
2085 if (ZEND_IS_INCREMENT(opline->opcode)) {
2086 increment_function(&z_copy);
2087 } else {
2088 decrement_function(&z_copy);
2089 }
2090 object->handlers->write_property(object, name, &z_copy, cache_slot);
2091 OBJ_RELEASE(object);
2092 zval_ptr_dtor(&z_copy);
2093 if (z == &rv) {
2094 zval_ptr_dtor(z);
2095 }
2096 }
2097
zend_pre_incdec_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)2098 static zend_never_inline void zend_pre_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
2099 {
2100 zval rv;
2101 zval *z;
2102 zval z_copy;
2103
2104 GC_ADDREF(object);
2105 z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2106 if (UNEXPECTED(EG(exception))) {
2107 OBJ_RELEASE(object);
2108 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2109 ZVAL_NULL(EX_VAR(opline->result.var));
2110 }
2111 return;
2112 }
2113
2114 ZVAL_COPY_DEREF(&z_copy, z);
2115 if (ZEND_IS_INCREMENT(opline->opcode)) {
2116 increment_function(&z_copy);
2117 } else {
2118 decrement_function(&z_copy);
2119 }
2120 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2121 ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
2122 }
2123 object->handlers->write_property(object, name, &z_copy, cache_slot);
2124 OBJ_RELEASE(object);
2125 zval_ptr_dtor(&z_copy);
2126 if (z == &rv) {
2127 zval_ptr_dtor(z);
2128 }
2129 }
2130
zend_assign_op_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot,zval * value OPLINE_DC EXECUTE_DATA_DC)2131 static zend_never_inline void zend_assign_op_overloaded_property(zend_object *object, zend_string *name, void **cache_slot, zval *value OPLINE_DC EXECUTE_DATA_DC)
2132 {
2133 zval *z;
2134 zval rv, res;
2135
2136 GC_ADDREF(object);
2137 z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2138 if (UNEXPECTED(EG(exception))) {
2139 OBJ_RELEASE(object);
2140 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2141 ZVAL_UNDEF(EX_VAR(opline->result.var));
2142 }
2143 return;
2144 }
2145 if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
2146 object->handlers->write_property(object, name, &res, cache_slot);
2147 }
2148 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2149 ZVAL_COPY(EX_VAR(opline->result.var), &res);
2150 }
2151 if (z == &rv) {
2152 zval_ptr_dtor(z);
2153 }
2154 zval_ptr_dtor(&res);
2155 OBJ_RELEASE(object);
2156 }
2157
2158 /* Utility Functions for Extensions */
zend_extension_statement_handler(const zend_extension * extension,zend_execute_data * frame)2159 static void zend_extension_statement_handler(const zend_extension *extension, zend_execute_data *frame)
2160 {
2161 if (extension->statement_handler) {
2162 extension->statement_handler(frame);
2163 }
2164 }
2165
2166
zend_extension_fcall_begin_handler(const zend_extension * extension,zend_execute_data * frame)2167 static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_execute_data *frame)
2168 {
2169 if (extension->fcall_begin_handler) {
2170 extension->fcall_begin_handler(frame);
2171 }
2172 }
2173
2174
zend_extension_fcall_end_handler(const zend_extension * extension,zend_execute_data * frame)2175 static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_execute_data *frame)
2176 {
2177 if (extension->fcall_end_handler) {
2178 extension->fcall_end_handler(frame);
2179 }
2180 }
2181
2182
zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)2183 static zend_always_inline HashTable *zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)
2184 {
2185 HashTable *ht;
2186
2187 if (EXPECTED(fetch_type & (ZEND_FETCH_GLOBAL_LOCK | ZEND_FETCH_GLOBAL))) {
2188 ht = &EG(symbol_table);
2189 } else {
2190 ZEND_ASSERT(fetch_type & ZEND_FETCH_LOCAL);
2191 if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
2192 zend_rebuild_symbol_table();
2193 }
2194 ht = EX(symbol_table);
2195 }
2196 return ht;
2197 }
2198
zend_undefined_offset(zend_long lval)2199 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_offset(zend_long lval)
2200 {
2201 zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, lval);
2202 }
2203
zend_undefined_index(const zend_string * offset)2204 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_index(const zend_string *offset)
2205 {
2206 zend_error(E_WARNING, "Undefined array key \"%s\"", ZSTR_VAL(offset));
2207 }
2208
zend_undefined_offset_write(HashTable * ht,zend_long lval)2209 ZEND_API ZEND_COLD zval* ZEND_FASTCALL zend_undefined_offset_write(HashTable *ht, zend_long lval)
2210 {
2211 /* The array may be destroyed while throwing the notice.
2212 * Temporarily increase the refcount to detect this situation. */
2213 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2214 GC_ADDREF(ht);
2215 }
2216 zend_undefined_offset(lval);
2217 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2218 if (!GC_REFCOUNT(ht)) {
2219 zend_array_destroy(ht);
2220 }
2221 return NULL;
2222 }
2223 if (EG(exception)) {
2224 return NULL;
2225 }
2226 return zend_hash_index_add_new(ht, lval, &EG(uninitialized_zval));
2227 }
2228
zend_undefined_index_write(HashTable * ht,zend_string * offset)2229 ZEND_API ZEND_COLD zval* ZEND_FASTCALL zend_undefined_index_write(HashTable *ht, zend_string *offset)
2230 {
2231 zval *retval;
2232
2233 /* The array may be destroyed while throwing the notice.
2234 * Temporarily increase the refcount to detect this situation. */
2235 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2236 GC_ADDREF(ht);
2237 }
2238 /* Key may be released while throwing the undefined index warning. */
2239 zend_string_addref(offset);
2240 zend_undefined_index(offset);
2241 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2242 if (!GC_REFCOUNT(ht)) {
2243 zend_array_destroy(ht);
2244 }
2245 retval = NULL;
2246 } else if (EG(exception)) {
2247 retval = NULL;
2248 } else {
2249 retval = zend_hash_add_new(ht, offset, &EG(uninitialized_zval));
2250 }
2251 zend_string_release(offset);
2252 return retval;
2253 }
2254
zend_undefined_method(const zend_class_entry * ce,const zend_string * method)2255 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
2256 {
2257 zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
2258 }
2259
zend_invalid_method_call(zval * object,zval * function_name)2260 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_invalid_method_call(zval *object, zval *function_name)
2261 {
2262 zend_throw_error(NULL, "Call to a member function %s() on %s",
2263 Z_STRVAL_P(function_name), zend_zval_value_name(object));
2264 }
2265
zend_non_static_method_call(const zend_function * fbc)2266 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_non_static_method_call(const zend_function *fbc)
2267 {
2268 zend_throw_error(
2269 zend_ce_error,
2270 "Non-static method %s::%s() cannot be called statically",
2271 ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2272 }
2273
zend_param_must_be_ref(const zend_function * func,uint32_t arg_num)2274 ZEND_COLD void ZEND_FASTCALL zend_param_must_be_ref(const zend_function *func, uint32_t arg_num)
2275 {
2276 const char *arg_name = get_function_arg_name(func, arg_num);
2277
2278 zend_error(E_WARNING, "%s%s%s(): Argument #%d%s%s%s must be passed by reference, value given",
2279 func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
2280 func->common.scope ? "::" : "",
2281 ZSTR_VAL(func->common.function_name),
2282 arg_num,
2283 arg_name ? " ($" : "",
2284 arg_name ? arg_name : "",
2285 arg_name ? ")" : ""
2286 );
2287 }
2288
zend_use_scalar_as_array(void)2289 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(void)
2290 {
2291 zend_throw_error(NULL, "Cannot use a scalar value as an array");
2292 }
2293
zend_cannot_add_element(void)2294 ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
2295 {
2296 zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
2297 }
2298
zend_use_resource_as_offset(const zval * dim)2299 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_use_resource_as_offset(const zval *dim)
2300 {
2301 zend_error(E_WARNING,
2302 "Resource ID#" ZEND_LONG_FMT " used as offset, casting to integer (" ZEND_LONG_FMT ")",
2303 Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
2304 }
2305
zend_use_new_element_for_string(void)2306 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_string(void)
2307 {
2308 zend_throw_error(NULL, "[] operator not supported for strings");
2309 }
2310
2311 #ifdef ZEND_CHECK_STACK_LIMIT
zend_call_stack_size_error(void)2312 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_call_stack_size_error(void)
2313 {
2314 zend_throw_error(NULL, "Maximum call stack size of %zu bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?",
2315 (size_t) ((uintptr_t) EG(stack_base) - (uintptr_t) EG(stack_limit)));
2316 }
2317 #endif /* ZEND_CHECK_STACK_LIMIT */
2318
zend_binary_assign_op_dim_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2319 static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2320 {
2321 if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2322 if (opline->op2_type == IS_UNUSED) {
2323 zend_use_new_element_for_string();
2324 } else {
2325 zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
2326 zend_wrong_string_offset_error();
2327 }
2328 } else {
2329 zend_use_scalar_as_array();
2330 }
2331 }
2332
slow_index_convert(HashTable * ht,const zval * dim,zend_value * value EXECUTE_DATA_DC)2333 static zend_never_inline uint8_t slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2334 {
2335 switch (Z_TYPE_P(dim)) {
2336 case IS_UNDEF: {
2337 /* The array may be destroyed while throwing the notice.
2338 * Temporarily increase the refcount to detect this situation. */
2339 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2340 GC_ADDREF(ht);
2341 }
2342 ZVAL_UNDEFINED_OP2();
2343 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2344 zend_array_destroy(ht);
2345 return IS_NULL;
2346 }
2347 if (EG(exception)) {
2348 return IS_NULL;
2349 }
2350 ZEND_FALLTHROUGH;
2351 }
2352 case IS_NULL:
2353 value->str = ZSTR_EMPTY_ALLOC();
2354 return IS_STRING;
2355 case IS_DOUBLE:
2356 value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2357 if (!zend_is_long_compatible(Z_DVAL_P(dim), value->lval)) {
2358 /* The array may be destroyed while throwing the notice.
2359 * Temporarily increase the refcount to detect this situation. */
2360 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2361 GC_ADDREF(ht);
2362 }
2363 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
2364 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2365 zend_array_destroy(ht);
2366 return IS_NULL;
2367 }
2368 if (EG(exception)) {
2369 return IS_NULL;
2370 }
2371 }
2372 return IS_LONG;
2373 case IS_RESOURCE:
2374 /* The array may be destroyed while throwing the notice.
2375 * Temporarily increase the refcount to detect this situation. */
2376 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2377 GC_ADDREF(ht);
2378 }
2379 zend_use_resource_as_offset(dim);
2380 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2381 zend_array_destroy(ht);
2382 return IS_NULL;
2383 }
2384 if (EG(exception)) {
2385 return IS_NULL;
2386 }
2387 value->lval = Z_RES_HANDLE_P(dim);
2388 return IS_LONG;
2389 case IS_FALSE:
2390 value->lval = 0;
2391 return IS_LONG;
2392 case IS_TRUE:
2393 value->lval = 1;
2394 return IS_LONG;
2395 default:
2396 zend_illegal_array_offset_access(dim);
2397 return IS_NULL;
2398 }
2399 }
2400
slow_index_convert_w(HashTable * ht,const zval * dim,zend_value * value EXECUTE_DATA_DC)2401 static zend_never_inline uint8_t slow_index_convert_w(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2402 {
2403 switch (Z_TYPE_P(dim)) {
2404 case IS_UNDEF: {
2405 /* The array may be destroyed while throwing the notice.
2406 * Temporarily increase the refcount to detect this situation. */
2407 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2408 GC_ADDREF(ht);
2409 }
2410 ZVAL_UNDEFINED_OP2();
2411 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2412 if (!GC_REFCOUNT(ht)) {
2413 zend_array_destroy(ht);
2414 }
2415 return IS_NULL;
2416 }
2417 if (EG(exception)) {
2418 return IS_NULL;
2419 }
2420 ZEND_FALLTHROUGH;
2421 }
2422 case IS_NULL:
2423 value->str = ZSTR_EMPTY_ALLOC();
2424 return IS_STRING;
2425 case IS_DOUBLE:
2426 value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2427 if (!zend_is_long_compatible(Z_DVAL_P(dim), value->lval)) {
2428 /* The array may be destroyed while throwing the notice.
2429 * Temporarily increase the refcount to detect this situation. */
2430 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2431 GC_ADDREF(ht);
2432 }
2433 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
2434 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2435 if (!GC_REFCOUNT(ht)) {
2436 zend_array_destroy(ht);
2437 }
2438 return IS_NULL;
2439 }
2440 if (EG(exception)) {
2441 return IS_NULL;
2442 }
2443 }
2444 return IS_LONG;
2445 case IS_RESOURCE:
2446 /* The array may be destroyed while throwing the notice.
2447 * Temporarily increase the refcount to detect this situation. */
2448 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2449 GC_ADDREF(ht);
2450 }
2451 zend_use_resource_as_offset(dim);
2452 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2453 if (!GC_REFCOUNT(ht)) {
2454 zend_array_destroy(ht);
2455 }
2456 return IS_NULL;
2457 }
2458 if (EG(exception)) {
2459 return IS_NULL;
2460 }
2461 value->lval = Z_RES_HANDLE_P(dim);
2462 return IS_LONG;
2463 case IS_FALSE:
2464 value->lval = 0;
2465 return IS_LONG;
2466 case IS_TRUE:
2467 value->lval = 1;
2468 return IS_LONG;
2469 default:
2470 zend_illegal_array_offset_access(dim);
2471 return IS_NULL;
2472 }
2473 }
2474
zend_fetch_dimension_address_inner(HashTable * ht,const zval * dim,int dim_type,int type EXECUTE_DATA_DC)2475 static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2476 {
2477 zval *retval = NULL;
2478 zend_string *offset_key;
2479 zend_ulong hval;
2480
2481 try_again:
2482 if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
2483 hval = Z_LVAL_P(dim);
2484 num_index:
2485 if (type != BP_VAR_W) {
2486 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
2487 return retval;
2488 num_undef:
2489 switch (type) {
2490 case BP_VAR_R:
2491 zend_undefined_offset(hval);
2492 ZEND_FALLTHROUGH;
2493 case BP_VAR_UNSET:
2494 case BP_VAR_IS:
2495 retval = &EG(uninitialized_zval);
2496 break;
2497 case BP_VAR_RW:
2498 retval = zend_undefined_offset_write(ht, hval);
2499 break;
2500 }
2501 } else {
2502 ZEND_HASH_INDEX_LOOKUP(ht, hval, retval);
2503 }
2504 } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
2505 offset_key = Z_STR_P(dim);
2506 if (ZEND_CONST_COND(dim_type != IS_CONST, 1)) {
2507 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
2508 goto num_index;
2509 }
2510 }
2511 str_index:
2512 if (type != BP_VAR_W) {
2513 retval = zend_hash_find_ex(ht, offset_key, ZEND_CONST_COND(dim_type == IS_CONST, 0));
2514 if (!retval) {
2515 switch (type) {
2516 case BP_VAR_R:
2517 zend_undefined_index(offset_key);
2518 ZEND_FALLTHROUGH;
2519 case BP_VAR_UNSET:
2520 case BP_VAR_IS:
2521 retval = &EG(uninitialized_zval);
2522 break;
2523 case BP_VAR_RW:
2524 retval = zend_undefined_index_write(ht, offset_key);
2525 break;
2526 }
2527 }
2528 } else {
2529 retval = zend_hash_lookup(ht, offset_key);
2530 }
2531 } else if (EXPECTED(Z_TYPE_P(dim) == IS_REFERENCE)) {
2532 dim = Z_REFVAL_P(dim);
2533 goto try_again;
2534 } else {
2535 zend_value val;
2536 uint8_t t;
2537
2538 if (type != BP_VAR_W && type != BP_VAR_RW) {
2539 t = slow_index_convert(ht, dim, &val EXECUTE_DATA_CC);
2540 } else {
2541 t = slow_index_convert_w(ht, dim, &val EXECUTE_DATA_CC);
2542 }
2543 if (t == IS_STRING) {
2544 offset_key = val.str;
2545 goto str_index;
2546 } else if (t == IS_LONG) {
2547 hval = val.lval;
2548 goto num_index;
2549 } else {
2550 retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
2551 NULL : &EG(uninitialized_zval);
2552 }
2553 }
2554 return retval;
2555 }
2556
zend_fetch_dimension_address_inner_W(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2557 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2558 {
2559 return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_W EXECUTE_DATA_CC);
2560 }
2561
zend_fetch_dimension_address_inner_W_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2562 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2563 {
2564 return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_W EXECUTE_DATA_CC);
2565 }
2566
zend_fetch_dimension_address_inner_RW(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2567 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2568 {
2569 return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_RW EXECUTE_DATA_CC);
2570 }
2571
zend_fetch_dimension_address_inner_RW_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2572 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2573 {
2574 return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_RW EXECUTE_DATA_CC);
2575 }
2576
zend_fetch_dimension_address(zval * result,zval * container,zval * dim,int dim_type,int type EXECUTE_DATA_DC)2577 static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container, zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2578 {
2579 zval *retval;
2580
2581 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2582 try_array:
2583 SEPARATE_ARRAY(container);
2584 fetch_from_array:
2585 if (dim == NULL) {
2586 retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
2587 if (UNEXPECTED(retval == NULL)) {
2588 zend_cannot_add_element();
2589 ZVAL_UNDEF(result);
2590 return;
2591 }
2592 } else {
2593 retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2594 if (UNEXPECTED(!retval)) {
2595 /* This may fail without throwing if the array was modified while throwing an
2596 * undefined index error. */
2597 ZVAL_NULL(result);
2598 return;
2599 }
2600 }
2601 ZVAL_INDIRECT(result, retval);
2602 return;
2603 } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2604 zend_reference *ref = Z_REF_P(container);
2605 container = Z_REFVAL_P(container);
2606 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2607 goto try_array;
2608 } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2609 if (type != BP_VAR_UNSET) {
2610 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2611 if (UNEXPECTED(!zend_verify_ref_array_assignable(ref))) {
2612 ZVAL_UNDEF(result);
2613 return;
2614 }
2615 }
2616 array_init(container);
2617 goto fetch_from_array;
2618 } else {
2619 goto return_null;
2620 }
2621 }
2622 }
2623 if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2624 if (dim == NULL) {
2625 zend_use_new_element_for_string();
2626 } else {
2627 zend_check_string_offset(dim, type EXECUTE_DATA_CC);
2628 zend_wrong_string_offset_error();
2629 }
2630 ZVAL_UNDEF(result);
2631 } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2632 zend_object *obj = Z_OBJ_P(container);
2633 GC_ADDREF(obj);
2634 if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2635 dim = ZVAL_UNDEFINED_OP2();
2636 } else if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2637 dim++;
2638 }
2639 retval = obj->handlers->read_dimension(obj, dim, type, result);
2640
2641 if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
2642 zend_class_entry *ce = obj->ce;
2643
2644 ZVAL_NULL(result);
2645 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2646 } else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
2647 if (!Z_ISREF_P(retval)) {
2648 if (result != retval) {
2649 ZVAL_COPY(result, retval);
2650 retval = result;
2651 }
2652 if (Z_TYPE_P(retval) != IS_OBJECT) {
2653 zend_class_entry *ce = obj->ce;
2654 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2655 }
2656 } else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) {
2657 ZVAL_UNREF(retval);
2658 }
2659 if (result != retval) {
2660 ZVAL_INDIRECT(result, retval);
2661 }
2662 } else {
2663 ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception");
2664 ZVAL_UNDEF(result);
2665 }
2666 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
2667 zend_objects_store_del(obj);
2668 }
2669 } else {
2670 if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2671 if (type != BP_VAR_W && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2672 ZVAL_UNDEFINED_OP1();
2673 }
2674 if (type != BP_VAR_UNSET) {
2675 HashTable *ht = zend_new_array(0);
2676 uint8_t old_type = Z_TYPE_P(container);
2677
2678 ZVAL_ARR(container, ht);
2679 if (UNEXPECTED(old_type == IS_FALSE)) {
2680 GC_ADDREF(ht);
2681 zend_false_to_array_deprecated();
2682 if (UNEXPECTED(GC_DELREF(ht) == 0)) {
2683 zend_array_destroy(ht);
2684 goto return_null;
2685 }
2686 }
2687 goto fetch_from_array;
2688 } else {
2689 if (UNEXPECTED(Z_TYPE_P(container) == IS_FALSE)) {
2690 zend_false_to_array_deprecated();
2691 }
2692 return_null:
2693 /* for read-mode only */
2694 if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2695 ZVAL_UNDEFINED_OP2();
2696 }
2697 ZVAL_NULL(result);
2698 }
2699 } else {
2700 if (type == BP_VAR_UNSET) {
2701 zend_throw_error(NULL, "Cannot unset offset in a non-array variable");
2702 ZVAL_UNDEF(result);
2703 } else {
2704 zend_use_scalar_as_array();
2705 ZVAL_UNDEF(result);
2706 }
2707 }
2708 }
2709 }
2710
zend_fetch_dimension_address_W(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2711 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_W(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2712 {
2713 zval *result = EX_VAR(opline->result.var);
2714 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W EXECUTE_DATA_CC);
2715 }
2716
zend_fetch_dimension_address_RW(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2717 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_RW(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2718 {
2719 zval *result = EX_VAR(opline->result.var);
2720 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW EXECUTE_DATA_CC);
2721 }
2722
zend_fetch_dimension_address_UNSET(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2723 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_UNSET(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2724 {
2725 zval *result = EX_VAR(opline->result.var);
2726 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET EXECUTE_DATA_CC);
2727 }
2728
zend_fetch_dimension_address_read(zval * result,zval * container,zval * dim,int dim_type,int type,bool is_list,int slow EXECUTE_DATA_DC)2729 static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, bool is_list, int slow EXECUTE_DATA_DC)
2730 {
2731 zval *retval;
2732
2733 if (!slow) {
2734 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2735 try_array:
2736 retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2737 ZVAL_COPY_DEREF(result, retval);
2738 return;
2739 } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2740 container = Z_REFVAL_P(container);
2741 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2742 goto try_array;
2743 }
2744 }
2745 }
2746 if (!is_list && EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2747 zend_string *str = Z_STR_P(container);
2748 zend_long offset;
2749
2750 try_string_offset:
2751 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
2752 switch (Z_TYPE_P(dim)) {
2753 case IS_STRING:
2754 {
2755 bool trailing_data = false;
2756 /* For BC reasons we allow errors so that we can warn on leading numeric string */
2757 if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset,
2758 NULL, /* allow errors */ true, NULL, &trailing_data)) {
2759 if (UNEXPECTED(trailing_data)) {
2760 zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
2761 }
2762 goto out;
2763 }
2764 if (type == BP_VAR_IS) {
2765 ZVAL_NULL(result);
2766 return;
2767 }
2768 zend_illegal_string_offset(dim, BP_VAR_R);
2769 ZVAL_NULL(result);
2770 return;
2771 }
2772 case IS_UNDEF:
2773 /* The string may be destroyed while throwing the notice.
2774 * Temporarily increase the refcount to detect this situation. */
2775 if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
2776 GC_ADDREF(str);
2777 }
2778 ZVAL_UNDEFINED_OP2();
2779 if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
2780 zend_string_efree(str);
2781 ZVAL_NULL(result);
2782 return;
2783 }
2784 ZEND_FALLTHROUGH;
2785 case IS_DOUBLE:
2786 case IS_NULL:
2787 case IS_FALSE:
2788 case IS_TRUE:
2789 if (type != BP_VAR_IS) {
2790 /* The string may be destroyed while throwing the notice.
2791 * Temporarily increase the refcount to detect this situation. */
2792 if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
2793 GC_ADDREF(str);
2794 }
2795 zend_error(E_WARNING, "String offset cast occurred");
2796 if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
2797 zend_string_efree(str);
2798 ZVAL_NULL(result);
2799 return;
2800 }
2801 }
2802 break;
2803 case IS_REFERENCE:
2804 dim = Z_REFVAL_P(dim);
2805 goto try_string_offset;
2806 default:
2807 zend_illegal_string_offset(dim, BP_VAR_R);
2808 ZVAL_NULL(result);
2809 return;
2810 }
2811
2812 offset = zval_get_long_func(dim, /* is_strict */ false);
2813 } else {
2814 offset = Z_LVAL_P(dim);
2815 }
2816 out:
2817
2818 if (UNEXPECTED(ZSTR_LEN(str) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
2819 if (type != BP_VAR_IS) {
2820 zend_error(E_WARNING, "Uninitialized string offset " ZEND_LONG_FMT, offset);
2821 ZVAL_EMPTY_STRING(result);
2822 } else {
2823 ZVAL_NULL(result);
2824 }
2825 } else {
2826 zend_uchar c;
2827 zend_long real_offset;
2828
2829 real_offset = (UNEXPECTED(offset < 0)) /* Handle negative offset */
2830 ? (zend_long)ZSTR_LEN(str) + offset : offset;
2831 c = (zend_uchar)ZSTR_VAL(str)[real_offset];
2832
2833 ZVAL_CHAR(result, c);
2834 }
2835 } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2836 zend_object *obj = Z_OBJ_P(container);
2837
2838 GC_ADDREF(obj);
2839 if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2840 dim = ZVAL_UNDEFINED_OP2();
2841 }
2842 if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2843 dim++;
2844 }
2845 retval = obj->handlers->read_dimension(obj, dim, type, result);
2846
2847 ZEND_ASSERT(result != NULL);
2848 if (retval) {
2849 if (result != retval) {
2850 ZVAL_COPY_DEREF(result, retval);
2851 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
2852 zend_unwrap_reference(result);
2853 }
2854 } else {
2855 ZVAL_NULL(result);
2856 }
2857 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
2858 zend_objects_store_del(obj);
2859 }
2860 } else {
2861 if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2862 container = ZVAL_UNDEFINED_OP1();
2863 }
2864 if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2865 ZVAL_UNDEFINED_OP2();
2866 }
2867 if (!is_list && type != BP_VAR_IS) {
2868 zend_error(E_WARNING, "Trying to access array offset on %s",
2869 zend_zval_value_name(container));
2870 }
2871 ZVAL_NULL(result);
2872 }
2873 }
2874
zend_fetch_dimension_address_read_R(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2875 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_R(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2876 {
2877 zval *result = EX_VAR(opline->result.var);
2878 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
2879 }
2880
zend_fetch_dimension_address_read_R_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2881 static zend_never_inline void zend_fetch_dimension_address_read_R_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2882 {
2883 zval *result = EX_VAR(opline->result.var);
2884 zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 0, 1 EXECUTE_DATA_CC);
2885 }
2886
zend_fetch_dimension_address_read_IS(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2887 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_IS(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2888 {
2889 zval *result = EX_VAR(opline->result.var);
2890 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 0, 0 EXECUTE_DATA_CC);
2891 }
2892
zend_fetch_dimension_address_LIST_r(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2893 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2894 {
2895 zval *result = EX_VAR(opline->result.var);
2896 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0 EXECUTE_DATA_CC);
2897 }
2898
zend_fetch_dimension_const(zval * result,zval * container,zval * dim,int type)2899 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)
2900 {
2901 zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 0, 0 NO_EXECUTE_DATA_CC);
2902 }
2903
zend_find_array_dim_slow(HashTable * ht,zval * offset EXECUTE_DATA_DC)2904 static zend_never_inline zval* ZEND_FASTCALL zend_find_array_dim_slow(HashTable *ht, zval *offset EXECUTE_DATA_DC)
2905 {
2906 zend_ulong hval;
2907
2908 if (Z_TYPE_P(offset) == IS_DOUBLE) {
2909 hval = zend_dval_to_lval_safe(Z_DVAL_P(offset));
2910 num_idx:
2911 return zend_hash_index_find(ht, hval);
2912 } else if (Z_TYPE_P(offset) == IS_NULL) {
2913 str_idx:
2914 return zend_hash_find_known_hash(ht, ZSTR_EMPTY_ALLOC());
2915 } else if (Z_TYPE_P(offset) == IS_FALSE) {
2916 hval = 0;
2917 goto num_idx;
2918 } else if (Z_TYPE_P(offset) == IS_TRUE) {
2919 hval = 1;
2920 goto num_idx;
2921 } else if (Z_TYPE_P(offset) == IS_RESOURCE) {
2922 zend_use_resource_as_offset(offset);
2923 hval = Z_RES_HANDLE_P(offset);
2924 goto num_idx;
2925 } else if (/*OP2_TYPE == IS_CV &&*/ Z_TYPE_P(offset) == IS_UNDEF) {
2926 ZVAL_UNDEFINED_OP2();
2927 goto str_idx;
2928 } else {
2929 zend_illegal_array_offset_isset(offset);
2930 return NULL;
2931 }
2932 }
2933
zend_isset_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2934 static zend_never_inline bool ZEND_FASTCALL zend_isset_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2935 {
2936 if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2937 offset = ZVAL_UNDEFINED_OP2();
2938 }
2939
2940 if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2941 return Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 0);
2942 } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2943 zend_long lval;
2944
2945 if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2946 lval = Z_LVAL_P(offset);
2947 str_offset:
2948 if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2949 lval += (zend_long)Z_STRLEN_P(container);
2950 }
2951 if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2952 return 1;
2953 } else {
2954 return 0;
2955 }
2956 } else {
2957 /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2958 ZVAL_DEREF(offset);
2959 /*}*/
2960 if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
2961 || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
2962 && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
2963 lval = zval_get_long_ex(offset, /* is_strict */ true);
2964 goto str_offset;
2965 }
2966 return 0;
2967 }
2968 } else {
2969 return 0;
2970 }
2971 }
2972
zend_isempty_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2973 static zend_never_inline bool ZEND_FASTCALL zend_isempty_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2974 {
2975 if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2976 offset = ZVAL_UNDEFINED_OP2();
2977 }
2978
2979 if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2980 return !Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 1);
2981 } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2982 zend_long lval;
2983
2984 if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2985 lval = Z_LVAL_P(offset);
2986 str_offset:
2987 if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2988 lval += (zend_long)Z_STRLEN_P(container);
2989 }
2990 if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2991 return (Z_STRVAL_P(container)[lval] == '0');
2992 } else {
2993 return 1;
2994 }
2995 } else {
2996 /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2997 ZVAL_DEREF(offset);
2998 /*}*/
2999 if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
3000 || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
3001 && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
3002 lval = zval_get_long_ex(offset, /* is_strict */ true);
3003 goto str_offset;
3004 }
3005 return 1;
3006 }
3007 } else {
3008 return 1;
3009 }
3010 }
3011
zend_array_key_exists_fast(HashTable * ht,zval * key OPLINE_DC EXECUTE_DATA_DC)3012 static zend_never_inline bool ZEND_FASTCALL zend_array_key_exists_fast(HashTable *ht, zval *key OPLINE_DC EXECUTE_DATA_DC)
3013 {
3014 zend_string *str;
3015 zend_ulong hval;
3016
3017 try_again:
3018 if (EXPECTED(Z_TYPE_P(key) == IS_STRING)) {
3019 str = Z_STR_P(key);
3020 if (ZEND_HANDLE_NUMERIC(str, hval)) {
3021 goto num_key;
3022 }
3023 str_key:
3024 return zend_hash_exists(ht, str);
3025 } else if (EXPECTED(Z_TYPE_P(key) == IS_LONG)) {
3026 hval = Z_LVAL_P(key);
3027 num_key:
3028 return zend_hash_index_exists(ht, hval);
3029 } else if (EXPECTED(Z_ISREF_P(key))) {
3030 key = Z_REFVAL_P(key);
3031 goto try_again;
3032 } else if (Z_TYPE_P(key) == IS_DOUBLE) {
3033 hval = zend_dval_to_lval_safe(Z_DVAL_P(key));
3034 goto num_key;
3035 } else if (Z_TYPE_P(key) == IS_FALSE) {
3036 hval = 0;
3037 goto num_key;
3038 } else if (Z_TYPE_P(key) == IS_TRUE) {
3039 hval = 1;
3040 goto num_key;
3041 } else if (Z_TYPE_P(key) == IS_RESOURCE) {
3042 zend_use_resource_as_offset(key);
3043 hval = Z_RES_HANDLE_P(key);
3044 goto num_key;
3045 } else if (Z_TYPE_P(key) <= IS_NULL) {
3046 if (UNEXPECTED(Z_TYPE_P(key) == IS_UNDEF)) {
3047 ZVAL_UNDEFINED_OP1();
3048 }
3049 str = ZSTR_EMPTY_ALLOC();
3050 goto str_key;
3051 } else {
3052 zend_illegal_array_offset_access(key);
3053 return 0;
3054 }
3055 }
3056
zend_array_key_exists_error(zval * subject,zval * key OPLINE_DC EXECUTE_DATA_DC)3057 static ZEND_COLD void ZEND_FASTCALL zend_array_key_exists_error(
3058 zval *subject, zval *key OPLINE_DC EXECUTE_DATA_DC)
3059 {
3060 if (Z_TYPE_P(key) == IS_UNDEF) {
3061 ZVAL_UNDEFINED_OP1();
3062 }
3063 if (Z_TYPE_P(subject) == IS_UNDEF) {
3064 ZVAL_UNDEFINED_OP2();
3065 }
3066 if (!EG(exception)) {
3067 zend_type_error("array_key_exists(): Argument #2 ($array) must be of type array, %s given",
3068 zend_zval_value_name(subject));
3069 }
3070 }
3071
promotes_to_array(zval * val)3072 static zend_always_inline bool promotes_to_array(zval *val) {
3073 return Z_TYPE_P(val) <= IS_FALSE
3074 || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE);
3075 }
3076
check_type_array_assignable(zend_type type)3077 static zend_always_inline bool check_type_array_assignable(zend_type type) {
3078 if (!ZEND_TYPE_IS_SET(type)) {
3079 return 1;
3080 }
3081 return (ZEND_TYPE_FULL_MASK(type) & MAY_BE_ARRAY) != 0;
3082 }
3083
3084 /* Checks whether an array can be assigned to the reference. Throws error if not assignable. */
zend_verify_ref_array_assignable(zend_reference * ref)3085 ZEND_API bool zend_verify_ref_array_assignable(zend_reference *ref) {
3086 zend_property_info *prop;
3087 ZEND_ASSERT(ZEND_REF_HAS_TYPE_SOURCES(ref));
3088 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3089 if (!check_type_array_assignable(prop->type)) {
3090 zend_throw_auto_init_in_ref_error(prop);
3091 return 0;
3092 }
3093 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
3094 return 1;
3095 }
3096
zend_object_fetch_property_type_info(zend_object * obj,zval * slot)3097 static zend_property_info *zend_object_fetch_property_type_info(
3098 zend_object *obj, zval *slot)
3099 {
3100 if (EXPECTED(!ZEND_CLASS_HAS_TYPE_HINTS(obj->ce))) {
3101 return NULL;
3102 }
3103
3104 /* Not a declared property */
3105 if (UNEXPECTED(slot < obj->properties_table ||
3106 slot >= obj->properties_table + obj->ce->default_properties_count)) {
3107 return NULL;
3108 }
3109
3110 return zend_get_typed_property_info_for_slot(obj, slot);
3111 }
3112
zend_handle_fetch_obj_flags(zval * result,zval * ptr,zend_object * obj,zend_property_info * prop_info,uint32_t flags)3113 static zend_never_inline bool zend_handle_fetch_obj_flags(
3114 zval *result, zval *ptr, zend_object *obj, zend_property_info *prop_info, uint32_t flags)
3115 {
3116 switch (flags) {
3117 case ZEND_FETCH_DIM_WRITE:
3118 if (promotes_to_array(ptr)) {
3119 if (!prop_info) {
3120 prop_info = zend_object_fetch_property_type_info(obj, ptr);
3121 if (!prop_info) {
3122 break;
3123 }
3124 }
3125 if (!check_type_array_assignable(prop_info->type)) {
3126 zend_throw_auto_init_in_prop_error(prop_info);
3127 if (result) ZVAL_ERROR(result);
3128 return 0;
3129 }
3130 }
3131 break;
3132 case ZEND_FETCH_REF:
3133 if (Z_TYPE_P(ptr) != IS_REFERENCE) {
3134 if (!prop_info) {
3135 prop_info = zend_object_fetch_property_type_info(obj, ptr);
3136 if (!prop_info) {
3137 break;
3138 }
3139 }
3140 if (Z_TYPE_P(ptr) == IS_UNDEF) {
3141 if (!ZEND_TYPE_ALLOW_NULL(prop_info->type)) {
3142 zend_throw_access_uninit_prop_by_ref_error(prop_info);
3143 if (result) ZVAL_ERROR(result);
3144 return 0;
3145 }
3146 ZVAL_NULL(ptr);
3147 }
3148
3149 ZVAL_NEW_REF(ptr, ptr);
3150 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(ptr), prop_info);
3151 }
3152 break;
3153 EMPTY_SWITCH_DEFAULT_CASE()
3154 }
3155 return 1;
3156 }
3157
zend_fetch_property_address(zval * result,zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,void ** cache_slot,int type,uint32_t flags OPLINE_DC EXECUTE_DATA_DC)3158 static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type, uint32_t flags OPLINE_DC EXECUTE_DATA_DC)
3159 {
3160 zval *ptr;
3161 zend_object *zobj;
3162 zend_string *name, *tmp_name;
3163
3164 if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
3165 do {
3166 if (Z_ISREF_P(container) && Z_TYPE_P(Z_REFVAL_P(container)) == IS_OBJECT) {
3167 container = Z_REFVAL_P(container);
3168 break;
3169 }
3170
3171 if (container_op_type == IS_CV
3172 && type != BP_VAR_W
3173 && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
3174 ZVAL_UNDEFINED_OP1();
3175 }
3176
3177 /* this should modify object only if it's empty */
3178 if (type == BP_VAR_UNSET) {
3179 ZVAL_NULL(result);
3180 return;
3181 }
3182
3183 zend_throw_non_object_error(container, prop_ptr OPLINE_CC EXECUTE_DATA_CC);
3184 ZVAL_ERROR(result);
3185 return;
3186 } while (0);
3187 }
3188
3189 zobj = Z_OBJ_P(container);
3190 if (prop_op_type == IS_CONST &&
3191 EXPECTED(zobj->ce == CACHED_PTR_EX(cache_slot))) {
3192 uintptr_t prop_offset = (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
3193
3194 if (EXPECTED(IS_VALID_PROPERTY_OFFSET(prop_offset))) {
3195 ptr = OBJ_PROP(zobj, prop_offset);
3196 if (EXPECTED(Z_TYPE_P(ptr) != IS_UNDEF)) {
3197 ZVAL_INDIRECT(result, ptr);
3198 zend_property_info *prop_info = CACHED_PTR_EX(cache_slot + 2);
3199 if (prop_info) {
3200 if (UNEXPECTED(prop_info->flags & ZEND_ACC_READONLY)) {
3201 /* For objects, W/RW/UNSET fetch modes might not actually modify object.
3202 * Similar as with magic __get() allow them, but return the value as a copy
3203 * to make sure no actual modification is possible. */
3204 ZEND_ASSERT(type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET);
3205 if (Z_TYPE_P(ptr) == IS_OBJECT) {
3206 ZVAL_COPY(result, ptr);
3207 } else if (Z_PROP_FLAG_P(ptr) & IS_PROP_REINITABLE) {
3208 Z_PROP_FLAG_P(ptr) &= ~IS_PROP_REINITABLE;
3209 } else {
3210 zend_readonly_property_modification_error(prop_info);
3211 ZVAL_ERROR(result);
3212 }
3213 return;
3214 }
3215 flags &= ZEND_FETCH_OBJ_FLAGS;
3216 if (flags) {
3217 zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags);
3218 }
3219 }
3220 return;
3221 }
3222 } else if (EXPECTED(zobj->properties != NULL)) {
3223 if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
3224 if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
3225 GC_DELREF(zobj->properties);
3226 }
3227 zobj->properties = zend_array_dup(zobj->properties);
3228 }
3229 ptr = zend_hash_find_known_hash(zobj->properties, Z_STR_P(prop_ptr));
3230 if (EXPECTED(ptr)) {
3231 ZVAL_INDIRECT(result, ptr);
3232 return;
3233 }
3234 }
3235 }
3236
3237 /* Pointer on property callback is required */
3238 ZEND_ASSERT(zobj->handlers->get_property_ptr_ptr != NULL);
3239
3240 if (prop_op_type == IS_CONST) {
3241 name = Z_STR_P(prop_ptr);
3242 } else {
3243 name = zval_get_tmp_string(prop_ptr, &tmp_name);
3244 }
3245 ptr = zobj->handlers->get_property_ptr_ptr(zobj, name, type, cache_slot);
3246 if (NULL == ptr) {
3247 ptr = zobj->handlers->read_property(zobj, name, type, cache_slot, result);
3248 if (ptr == result) {
3249 if (UNEXPECTED(Z_ISREF_P(ptr) && Z_REFCOUNT_P(ptr) == 1)) {
3250 ZVAL_UNREF(ptr);
3251 }
3252 goto end;
3253 }
3254 if (UNEXPECTED(EG(exception))) {
3255 ZVAL_ERROR(result);
3256 goto end;
3257 }
3258 } else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
3259 ZVAL_ERROR(result);
3260 goto end;
3261 }
3262
3263 ZVAL_INDIRECT(result, ptr);
3264 flags &= ZEND_FETCH_OBJ_FLAGS;
3265 if (flags) {
3266 zend_property_info *prop_info;
3267
3268 if (prop_op_type == IS_CONST) {
3269 prop_info = CACHED_PTR_EX(cache_slot + 2);
3270 if (prop_info) {
3271 if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags))) {
3272 goto end;
3273 }
3274 }
3275 } else {
3276 if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, Z_OBJ_P(container), NULL, flags))) {
3277 goto end;
3278 }
3279 }
3280 }
3281
3282 end:
3283 if (prop_op_type != IS_CONST) {
3284 zend_tmp_string_release(tmp_name);
3285 }
3286 }
3287
zend_assign_to_property_reference(zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3288 static zend_always_inline void zend_assign_to_property_reference(zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3289 {
3290 zval variable, *variable_ptr = &variable;
3291 void **cache_addr = (prop_op_type == IS_CONST) ? CACHE_ADDR(opline->extended_value & ~ZEND_RETURNS_FUNCTION) : NULL;
3292 zend_refcounted *garbage = NULL;
3293
3294 zend_fetch_property_address(variable_ptr, container, container_op_type, prop_ptr, prop_op_type,
3295 cache_addr, BP_VAR_W, 0 OPLINE_CC EXECUTE_DATA_CC);
3296
3297 if (EXPECTED(Z_TYPE_P(variable_ptr) == IS_INDIRECT)) {
3298 variable_ptr = Z_INDIRECT_P(variable_ptr);
3299 if (/*OP_DATA_TYPE == IS_VAR &&*/
3300 (opline->extended_value & ZEND_RETURNS_FUNCTION) &&
3301 UNEXPECTED(!Z_ISREF_P(value_ptr))) {
3302
3303 variable_ptr = zend_wrong_assign_to_variable_reference(
3304 variable_ptr, value_ptr, &garbage OPLINE_CC EXECUTE_DATA_CC);
3305 } else {
3306 zend_property_info *prop_info = NULL;
3307
3308 if (prop_op_type == IS_CONST) {
3309 prop_info = (zend_property_info *) CACHED_PTR_EX(cache_addr + 2);
3310 } else {
3311 ZVAL_DEREF(container);
3312 prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(container), variable_ptr);
3313 }
3314
3315 if (UNEXPECTED(prop_info)) {
3316 variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr, &garbage EXECUTE_DATA_CC);
3317 } else {
3318 zend_assign_to_variable_reference(variable_ptr, value_ptr, &garbage);
3319 }
3320 }
3321 } else if (Z_ISERROR_P(variable_ptr)) {
3322 variable_ptr = &EG(uninitialized_zval);
3323 } else {
3324 zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
3325 zval_ptr_dtor(&variable);
3326 variable_ptr = &EG(uninitialized_zval);
3327 }
3328
3329 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
3330 ZVAL_COPY(EX_VAR(opline->result.var), variable_ptr);
3331 }
3332 if (garbage) {
3333 GC_DTOR(garbage);
3334 }
3335 }
3336
zend_assign_to_property_reference_this_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3337 static zend_never_inline void zend_assign_to_property_reference_this_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3338 {
3339 zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_CONST, value_ptr
3340 OPLINE_CC EXECUTE_DATA_CC);
3341 }
3342
zend_assign_to_property_reference_var_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3343 static zend_never_inline void zend_assign_to_property_reference_var_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3344 {
3345 zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_CONST, value_ptr
3346 OPLINE_CC EXECUTE_DATA_CC);
3347 }
3348
zend_assign_to_property_reference_this_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3349 static zend_never_inline void zend_assign_to_property_reference_this_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3350 {
3351 zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_VAR, value_ptr
3352 OPLINE_CC EXECUTE_DATA_CC);
3353 }
3354
zend_assign_to_property_reference_var_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3355 static zend_never_inline void zend_assign_to_property_reference_var_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3356 {
3357 zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_VAR, value_ptr
3358 OPLINE_CC EXECUTE_DATA_CC);
3359 }
3360
zend_fetch_static_property_address_ex(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type OPLINE_DC EXECUTE_DATA_DC)3361 static zend_never_inline zend_result zend_fetch_static_property_address_ex(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type OPLINE_DC EXECUTE_DATA_DC) {
3362 zend_string *name;
3363 zend_class_entry *ce;
3364 zend_property_info *property_info;
3365
3366 uint8_t op1_type = opline->op1_type, op2_type = opline->op2_type;
3367
3368 if (EXPECTED(op2_type == IS_CONST)) {
3369 zval *class_name = RT_CONSTANT(opline, opline->op2);
3370
3371 ZEND_ASSERT(op1_type != IS_CONST || CACHED_PTR(cache_slot) == NULL);
3372
3373 if (EXPECTED((ce = CACHED_PTR(cache_slot)) == NULL)) {
3374 ce = zend_fetch_class_by_name(Z_STR_P(class_name), Z_STR_P(class_name + 1), ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
3375 if (UNEXPECTED(ce == NULL)) {
3376 FREE_OP(op1_type, opline->op1.var);
3377 return FAILURE;
3378 }
3379 if (UNEXPECTED(op1_type != IS_CONST)) {
3380 CACHE_PTR(cache_slot, ce);
3381 }
3382 }
3383 } else {
3384 if (EXPECTED(op2_type == IS_UNUSED)) {
3385 ce = zend_fetch_class(NULL, opline->op2.num);
3386 if (UNEXPECTED(ce == NULL)) {
3387 FREE_OP(op1_type, opline->op1.var);
3388 return FAILURE;
3389 }
3390 } else {
3391 ce = Z_CE_P(EX_VAR(opline->op2.var));
3392 }
3393 if (EXPECTED(op1_type == IS_CONST) && EXPECTED(CACHED_PTR(cache_slot) == ce)) {
3394 *retval = CACHED_PTR(cache_slot + sizeof(void *));
3395 *prop_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3396 return SUCCESS;
3397 }
3398 }
3399
3400 if (EXPECTED(op1_type == IS_CONST)) {
3401 name = Z_STR_P(RT_CONSTANT(opline, opline->op1));
3402 *retval = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3403 } else {
3404 zend_string *tmp_name;
3405 zval *varname = get_zval_ptr_undef(opline->op1_type, opline->op1, BP_VAR_R);
3406 if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {
3407 name = Z_STR_P(varname);
3408 tmp_name = NULL;
3409 } else {
3410 if (op1_type == IS_CV && UNEXPECTED(Z_TYPE_P(varname) == IS_UNDEF)) {
3411 zval_undefined_cv(opline->op1.var EXECUTE_DATA_CC);
3412 }
3413 name = zval_get_tmp_string(varname, &tmp_name);
3414 }
3415 *retval = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3416
3417 zend_tmp_string_release(tmp_name);
3418
3419 FREE_OP(op1_type, opline->op1.var);
3420 }
3421
3422 if (UNEXPECTED(*retval == NULL)) {
3423 return FAILURE;
3424 }
3425
3426 *prop_info = property_info;
3427
3428 if (EXPECTED(op1_type == IS_CONST)
3429 && EXPECTED(!(property_info->ce->ce_flags & ZEND_ACC_TRAIT))) {
3430 CACHE_POLYMORPHIC_PTR(cache_slot, ce, *retval);
3431 CACHE_PTR(cache_slot + sizeof(void *) * 2, property_info);
3432 }
3433
3434 return SUCCESS;
3435 }
3436
3437
zend_fetch_static_property_address(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type,int flags OPLINE_DC EXECUTE_DATA_DC)3438 static zend_always_inline zend_result zend_fetch_static_property_address(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type, int flags OPLINE_DC EXECUTE_DATA_DC) {
3439 zend_property_info *property_info;
3440
3441 if (opline->op1_type == IS_CONST && (opline->op2_type == IS_CONST || (opline->op2_type == IS_UNUSED && (opline->op2.num == ZEND_FETCH_CLASS_SELF || opline->op2.num == ZEND_FETCH_CLASS_PARENT))) && EXPECTED(CACHED_PTR(cache_slot) != NULL)) {
3442 *retval = CACHED_PTR(cache_slot + sizeof(void *));
3443 property_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3444
3445 if ((fetch_type == BP_VAR_R || fetch_type == BP_VAR_RW)
3446 && UNEXPECTED(Z_TYPE_P(*retval) == IS_UNDEF)
3447 && UNEXPECTED(ZEND_TYPE_IS_SET(property_info->type))) {
3448 zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
3449 ZSTR_VAL(property_info->ce->name),
3450 zend_get_unmangled_property_name(property_info->name));
3451 return FAILURE;
3452 }
3453 } else {
3454 zend_result success;
3455 success = zend_fetch_static_property_address_ex(retval, &property_info, cache_slot, fetch_type OPLINE_CC EXECUTE_DATA_CC);
3456 if (UNEXPECTED(success != SUCCESS)) {
3457 return FAILURE;
3458 }
3459 }
3460
3461 flags &= ZEND_FETCH_OBJ_FLAGS;
3462 if (flags && ZEND_TYPE_IS_SET(property_info->type)) {
3463 zend_handle_fetch_obj_flags(NULL, *retval, NULL, property_info, flags);
3464 }
3465
3466 if (prop_info) {
3467 *prop_info = property_info;
3468 }
3469
3470 return SUCCESS;
3471 }
3472
zend_throw_ref_type_error_type(const zend_property_info * prop1,const zend_property_info * prop2,const zval * zv)3473 ZEND_API ZEND_COLD void zend_throw_ref_type_error_type(const zend_property_info *prop1, const zend_property_info *prop2, const zval *zv) {
3474 zend_string *type1_str = zend_type_to_string(prop1->type);
3475 zend_string *type2_str = zend_type_to_string(prop2->type);
3476 zend_type_error("Reference with value of type %s held by property %s::$%s of type %s is not compatible with property %s::$%s of type %s",
3477 zend_zval_type_name(zv),
3478 ZSTR_VAL(prop1->ce->name),
3479 zend_get_unmangled_property_name(prop1->name),
3480 ZSTR_VAL(type1_str),
3481 ZSTR_VAL(prop2->ce->name),
3482 zend_get_unmangled_property_name(prop2->name),
3483 ZSTR_VAL(type2_str)
3484 );
3485 zend_string_release(type1_str);
3486 zend_string_release(type2_str);
3487 }
3488
zend_throw_ref_type_error_zval(const zend_property_info * prop,const zval * zv)3489 ZEND_API ZEND_COLD void zend_throw_ref_type_error_zval(const zend_property_info *prop, const zval *zv) {
3490 zend_string *type_str = zend_type_to_string(prop->type);
3491 zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s",
3492 zend_zval_value_name(zv),
3493 ZSTR_VAL(prop->ce->name),
3494 zend_get_unmangled_property_name(prop->name),
3495 ZSTR_VAL(type_str)
3496 );
3497 zend_string_release(type_str);
3498 }
3499
zend_throw_conflicting_coercion_error(const zend_property_info * prop1,const zend_property_info * prop2,const zval * zv)3500 ZEND_API ZEND_COLD void zend_throw_conflicting_coercion_error(const zend_property_info *prop1, const zend_property_info *prop2, const zval *zv) {
3501 zend_string *type1_str = zend_type_to_string(prop1->type);
3502 zend_string *type2_str = zend_type_to_string(prop2->type);
3503 zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s and property %s::$%s of type %s, as this would result in an inconsistent type conversion",
3504 zend_zval_value_name(zv),
3505 ZSTR_VAL(prop1->ce->name),
3506 zend_get_unmangled_property_name(prop1->name),
3507 ZSTR_VAL(type1_str),
3508 ZSTR_VAL(prop2->ce->name),
3509 zend_get_unmangled_property_name(prop2->name),
3510 ZSTR_VAL(type2_str)
3511 );
3512 zend_string_release(type1_str);
3513 zend_string_release(type2_str);
3514 }
3515
3516 /* 1: valid, 0: invalid, -1: may be valid after type coercion */
i_zend_verify_type_assignable_zval(const zend_property_info * info,const zval * zv,bool strict)3517 static zend_always_inline int i_zend_verify_type_assignable_zval(
3518 const zend_property_info *info, const zval *zv, bool strict) {
3519 zend_type type = info->type;
3520 uint32_t type_mask;
3521 uint8_t zv_type = Z_TYPE_P(zv);
3522
3523 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(type, zv_type))) {
3524 return 1;
3525 }
3526
3527 if (ZEND_TYPE_IS_COMPLEX(type) && zv_type == IS_OBJECT
3528 && zend_check_and_resolve_property_or_class_constant_class_type(info->ce, info->type, Z_OBJCE_P(zv))) {
3529 return 1;
3530 }
3531
3532 type_mask = ZEND_TYPE_FULL_MASK(type);
3533 ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC)));
3534
3535 /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
3536 if (strict) {
3537 if ((type_mask & MAY_BE_DOUBLE) && zv_type == IS_LONG) {
3538 return -1;
3539 }
3540 return 0;
3541 }
3542
3543 /* NULL may be accepted only by nullable hints (this is already checked) */
3544 if (zv_type == IS_NULL) {
3545 return 0;
3546 }
3547
3548 /* Does not contain any type to which a coercion is possible */
3549 if (!(type_mask & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING))
3550 && (type_mask & MAY_BE_BOOL) != MAY_BE_BOOL) {
3551 return 0;
3552 }
3553
3554 /* Coercion may be necessary, check separately */
3555 return -1;
3556 }
3557
zend_verify_ref_assignable_zval(zend_reference * ref,zval * zv,bool strict)3558 ZEND_API bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference *ref, zval *zv, bool strict)
3559 {
3560 const zend_property_info *prop;
3561
3562 /* The value must satisfy each property type, and coerce to the same value for each property
3563 * type. Remember the first coerced type and value we've seen for this purpose. */
3564 const zend_property_info *first_prop = NULL;
3565 zval coerced_value;
3566 ZVAL_UNDEF(&coerced_value);
3567
3568 ZEND_ASSERT(Z_TYPE_P(zv) != IS_REFERENCE);
3569 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3570 int result = i_zend_verify_type_assignable_zval(prop, zv, strict);
3571 if (result == 0) {
3572 type_error:
3573 zend_throw_ref_type_error_zval(prop, zv);
3574 zval_ptr_dtor(&coerced_value);
3575 return 0;
3576 }
3577
3578 if (result < 0) {
3579 if (!first_prop) {
3580 first_prop = prop;
3581 ZVAL_COPY(&coerced_value, zv);
3582 if (!zend_verify_weak_scalar_type_hint(
3583 ZEND_TYPE_FULL_MASK(prop->type), &coerced_value)) {
3584 goto type_error;
3585 }
3586 } else if (Z_ISUNDEF(coerced_value)) {
3587 /* A previous property did not require coercion, but this one does,
3588 * so they are incompatible. */
3589 goto conflicting_coercion_error;
3590 } else {
3591 zval tmp;
3592 ZVAL_COPY(&tmp, zv);
3593 if (!zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop->type), &tmp)) {
3594 zval_ptr_dtor(&tmp);
3595 goto type_error;
3596 }
3597 if (!zend_is_identical(&coerced_value, &tmp)) {
3598 zval_ptr_dtor(&tmp);
3599 goto conflicting_coercion_error;
3600 }
3601 zval_ptr_dtor(&tmp);
3602 }
3603 } else {
3604 if (!first_prop) {
3605 first_prop = prop;
3606 } else if (!Z_ISUNDEF(coerced_value)) {
3607 /* A previous property required coercion, but this one doesn't,
3608 * so they are incompatible. */
3609 conflicting_coercion_error:
3610 zend_throw_conflicting_coercion_error(first_prop, prop, zv);
3611 zval_ptr_dtor(&coerced_value);
3612 return 0;
3613 }
3614 }
3615 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
3616
3617 if (!Z_ISUNDEF(coerced_value)) {
3618 zval_ptr_dtor(zv);
3619 ZVAL_COPY_VALUE(zv, &coerced_value);
3620 }
3621
3622 return 1;
3623 }
3624
i_zval_ptr_dtor_noref(zval * zval_ptr)3625 static zend_always_inline void i_zval_ptr_dtor_noref(zval *zval_ptr) {
3626 if (Z_REFCOUNTED_P(zval_ptr)) {
3627 zend_refcounted *ref = Z_COUNTED_P(zval_ptr);
3628 ZEND_ASSERT(Z_TYPE_P(zval_ptr) != IS_REFERENCE);
3629 GC_DTOR_NO_REF(ref);
3630 }
3631 }
3632
zend_assign_to_typed_ref_ex(zval * variable_ptr,zval * orig_value,uint8_t value_type,bool strict,zend_refcounted ** garbage_ptr)3633 ZEND_API zval* zend_assign_to_typed_ref_ex(zval *variable_ptr, zval *orig_value, uint8_t value_type, bool strict, zend_refcounted **garbage_ptr)
3634 {
3635 bool ret;
3636 zval value;
3637 zend_refcounted *ref = NULL;
3638
3639 if (Z_ISREF_P(orig_value)) {
3640 ref = Z_COUNTED_P(orig_value);
3641 orig_value = Z_REFVAL_P(orig_value);
3642 }
3643
3644 ZVAL_COPY(&value, orig_value);
3645 ret = zend_verify_ref_assignable_zval(Z_REF_P(variable_ptr), &value, strict);
3646 variable_ptr = Z_REFVAL_P(variable_ptr);
3647 if (EXPECTED(ret)) {
3648 if (Z_REFCOUNTED_P(variable_ptr)) {
3649 *garbage_ptr = Z_COUNTED_P(variable_ptr);
3650 }
3651 ZVAL_COPY_VALUE(variable_ptr, &value);
3652 } else {
3653 zval_ptr_dtor_nogc(&value);
3654 }
3655 if (value_type & (IS_VAR|IS_TMP_VAR)) {
3656 if (UNEXPECTED(ref)) {
3657 if (UNEXPECTED(GC_DELREF(ref) == 0)) {
3658 zval_ptr_dtor(orig_value);
3659 efree_size(ref, sizeof(zend_reference));
3660 }
3661 } else {
3662 i_zval_ptr_dtor_noref(orig_value);
3663 }
3664 }
3665 return variable_ptr;
3666 }
3667
zend_assign_to_typed_ref(zval * variable_ptr,zval * orig_value,uint8_t value_type,bool strict)3668 ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, uint8_t value_type, bool strict)
3669 {
3670 zend_refcounted *garbage = NULL;
3671 zval *result = zend_assign_to_typed_ref_ex(variable_ptr, orig_value, value_type, strict, &garbage);
3672 if (garbage) {
3673 GC_DTOR_NO_REF(garbage);
3674 }
3675 return result;
3676 }
3677
zend_verify_prop_assignable_by_ref_ex(const zend_property_info * prop_info,zval * orig_val,bool strict,zend_verify_prop_assignable_by_ref_context context)3678 ZEND_API bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref_ex(const zend_property_info *prop_info, zval *orig_val, bool strict, zend_verify_prop_assignable_by_ref_context context) {
3679 zval *val = orig_val;
3680 if (Z_ISREF_P(val) && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(val))) {
3681 int result;
3682
3683 val = Z_REFVAL_P(val);
3684 result = i_zend_verify_type_assignable_zval(prop_info, val, strict);
3685 if (result > 0) {
3686 return 1;
3687 }
3688
3689 if (result < 0) {
3690 /* This is definitely an error, but we still need to determined why: Either because
3691 * the value is simply illegal for the type, or because or a conflicting coercion. */
3692 zval tmp;
3693 ZVAL_COPY(&tmp, val);
3694 if (zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop_info->type), &tmp)) {
3695 const zend_property_info *ref_prop = ZEND_REF_FIRST_SOURCE(Z_REF_P(orig_val));
3696 zend_throw_ref_type_error_type(ref_prop, prop_info, val);
3697 zval_ptr_dtor(&tmp);
3698 return 0;
3699 }
3700 zval_ptr_dtor(&tmp);
3701 }
3702 } else {
3703 ZVAL_DEREF(val);
3704 if (i_zend_check_property_type(prop_info, val, strict)) {
3705 return 1;
3706 }
3707 }
3708
3709 if (EXPECTED(context == ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_ASSIGNMENT)) {
3710 zend_verify_property_type_error(prop_info, val);
3711 } else {
3712 ZEND_ASSERT(context == ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_MAGIC_GET);
3713 zend_magic_get_property_type_inconsistency_error(prop_info, val);
3714 }
3715
3716 return 0;
3717 }
3718
zend_verify_prop_assignable_by_ref(const zend_property_info * prop_info,zval * orig_val,bool strict)3719 ZEND_API bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref(const zend_property_info *prop_info, zval *orig_val, bool strict) {
3720 return zend_verify_prop_assignable_by_ref_ex(prop_info, orig_val, strict, ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_ASSIGNMENT);
3721 }
3722
zend_ref_add_type_source(zend_property_info_source_list * source_list,zend_property_info * prop)3723 ZEND_API void ZEND_FASTCALL zend_ref_add_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
3724 {
3725 zend_property_info_list *list;
3726 if (source_list->ptr == NULL) {
3727 source_list->ptr = prop;
3728 return;
3729 }
3730
3731 list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3732 if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3733 list = emalloc(sizeof(zend_property_info_list) + (4 - 1) * sizeof(zend_property_info *));
3734 list->ptr[0] = source_list->ptr;
3735 list->num_allocated = 4;
3736 list->num = 1;
3737 } else if (list->num_allocated == list->num) {
3738 list->num_allocated = list->num * 2;
3739 list = erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *));
3740 }
3741
3742 list->ptr[list->num++] = prop;
3743 source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(list);
3744 }
3745
zend_ref_del_type_source(zend_property_info_source_list * source_list,const zend_property_info * prop)3746 ZEND_API void ZEND_FASTCALL zend_ref_del_type_source(zend_property_info_source_list *source_list, const zend_property_info *prop)
3747 {
3748 zend_property_info_list *list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3749 zend_property_info **ptr, **end;
3750
3751 ZEND_ASSERT(prop);
3752 if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3753 ZEND_ASSERT(source_list->ptr == prop);
3754 source_list->ptr = NULL;
3755 return;
3756 }
3757
3758 if (list->num == 1) {
3759 ZEND_ASSERT(*list->ptr == prop);
3760 efree(list);
3761 source_list->ptr = NULL;
3762 return;
3763 }
3764
3765 /* Checking against end here to get a more graceful failure mode if we missed adding a type
3766 * source at some point. */
3767 ptr = list->ptr;
3768 end = ptr + list->num;
3769 while (ptr < end && *ptr != prop) {
3770 ptr++;
3771 }
3772 ZEND_ASSERT(*ptr == prop);
3773
3774 /* Copy the last list element into the deleted slot. */
3775 *ptr = list->ptr[--list->num];
3776
3777 if (list->num >= 4 && list->num * 4 == list->num_allocated) {
3778 list->num_allocated = list->num * 2;
3779 source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *)));
3780 }
3781 }
3782
zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)3783 static zend_never_inline void zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)
3784 {
3785 zval *result = EX_VAR(opline->result.var);
3786
3787 switch (type) {
3788 case BP_VAR_R:
3789 if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3790 ZVAL_OBJ(result, Z_OBJ(EX(This)));
3791 Z_ADDREF_P(result);
3792 } else {
3793 ZVAL_NULL(result);
3794 zend_error(E_WARNING, "Undefined variable $this");
3795 }
3796 break;
3797 case BP_VAR_IS:
3798 if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3799 ZVAL_OBJ(result, Z_OBJ(EX(This)));
3800 Z_ADDREF_P(result);
3801 } else {
3802 ZVAL_NULL(result);
3803 }
3804 break;
3805 case BP_VAR_RW:
3806 case BP_VAR_W:
3807 ZVAL_UNDEF(result);
3808 zend_throw_error(NULL, "Cannot re-assign $this");
3809 break;
3810 case BP_VAR_UNSET:
3811 ZVAL_UNDEF(result);
3812 zend_throw_error(NULL, "Cannot unset $this");
3813 break;
3814 EMPTY_SWITCH_DEFAULT_CASE()
3815 }
3816 }
3817
zend_wrong_clone_call(zend_function * clone,zend_class_entry * scope)3818 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_clone_call(zend_function *clone, zend_class_entry *scope)
3819 {
3820 zend_throw_error(NULL, "Call to %s %s::__clone() from %s%s",
3821 zend_visibility_string(clone->common.fn_flags), ZSTR_VAL(clone->common.scope->name),
3822 scope ? "scope " : "global scope",
3823 scope ? ZSTR_VAL(scope->name) : ""
3824 );
3825 }
3826
3827 #if ZEND_INTENSIVE_DEBUGGING
3828
3829 #define CHECK_SYMBOL_TABLES() \
3830 zend_hash_apply(&EG(symbol_table), zend_check_symbol); \
3831 if (&EG(symbol_table)!=EX(symbol_table)) { \
3832 zend_hash_apply(EX(symbol_table), zend_check_symbol); \
3833 }
3834
zend_check_symbol(zval * pz)3835 static void zend_check_symbol(zval *pz)
3836 {
3837 if (Z_TYPE_P(pz) == IS_INDIRECT) {
3838 pz = Z_INDIRECT_P(pz);
3839 }
3840 if (Z_TYPE_P(pz) > 10) {
3841 fprintf(stderr, "Warning! %x has invalid type!\n", *pz);
3842 /* See http://support.microsoft.com/kb/190351 */
3843 #ifdef ZEND_WIN32
3844 fflush(stderr);
3845 #endif
3846 } else if (Z_TYPE_P(pz) == IS_ARRAY) {
3847 zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol);
3848 } else if (Z_TYPE_P(pz) == IS_OBJECT) {
3849 /* OBJ-TBI - doesn't support new object model! */
3850 zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol);
3851 }
3852 }
3853
3854
3855 #else
3856 #define CHECK_SYMBOL_TABLES()
3857 #endif
3858
execute_internal(zend_execute_data * execute_data,zval * return_value)3859 ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value)
3860 {
3861 execute_data->func->internal_function.handler(execute_data, return_value);
3862 }
3863
zend_clean_and_cache_symbol_table(zend_array * symbol_table)3864 ZEND_API void zend_clean_and_cache_symbol_table(zend_array *symbol_table) /* {{{ */
3865 {
3866 /* Clean before putting into the cache, since clean could call dtors,
3867 * which could use the cached hash. Also do this before the check for
3868 * available cache slots, as those may be used by a dtor as well. */
3869 zend_symtable_clean(symbol_table);
3870 if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
3871 zend_array_destroy(symbol_table);
3872 } else {
3873 *(EG(symtable_cache_ptr)++) = symbol_table;
3874 }
3875 }
3876 /* }}} */
3877
i_free_compiled_variables(zend_execute_data * execute_data)3878 static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3879 {
3880 zval *cv = EX_VAR_NUM(0);
3881 int count = EX(func)->op_array.last_var;
3882 while (EXPECTED(count != 0)) {
3883 i_zval_ptr_dtor(cv);
3884 cv++;
3885 count--;
3886 }
3887 }
3888 /* }}} */
3889
zend_free_compiled_variables(zend_execute_data * execute_data)3890 ZEND_API void ZEND_FASTCALL zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3891 {
3892 i_free_compiled_variables(execute_data);
3893 }
3894 /* }}} */
3895
3896 #define ZEND_VM_INTERRUPT_CHECK() do { \
3897 if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
3898 ZEND_VM_INTERRUPT(); \
3899 } \
3900 } while (0)
3901
3902 #define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \
3903 if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
3904 ZEND_VM_LOOP_INTERRUPT(); \
3905 } \
3906 } while (0)
3907
3908 /*
3909 * Stack Frame Layout (the whole stack frame is allocated at once)
3910 * ==================
3911 *
3912 * +========================================+
3913 * EG(current_execute_data) -> | zend_execute_data |
3914 * +----------------------------------------+
3915 * EX_VAR_NUM(0) --------> | VAR[0] = ARG[1] |
3916 * | ... |
3917 * | VAR[op_array->num_args-1] = ARG[N] |
3918 * | ... |
3919 * | VAR[op_array->last_var-1] |
3920 * | VAR[op_array->last_var] = TMP[0] |
3921 * | ... |
3922 * | VAR[op_array->last_var+op_array->T-1] |
3923 * | ARG[N+1] (extra_args) |
3924 * | ... |
3925 * +----------------------------------------+
3926 */
3927
3928 /* zend_copy_extra_args is used when the actually passed number of arguments
3929 * (EX_NUM_ARGS) is greater than what the function defined (op_array->num_args).
3930 *
3931 * The extra arguments will be copied into the call frame after all the compiled variables.
3932 *
3933 * If there are extra arguments copied, a flag "ZEND_CALL_FREE_EXTRA_ARGS" will be set
3934 * on the zend_execute_data, and when the executor leaves the function, the
3935 * args will be freed in zend_leave_helper.
3936 */
zend_copy_extra_args(EXECUTE_DATA_D)3937 static zend_never_inline void zend_copy_extra_args(EXECUTE_DATA_D)
3938 {
3939 zend_op_array *op_array = &EX(func)->op_array;
3940 uint32_t first_extra_arg = op_array->num_args;
3941 uint32_t num_args = EX_NUM_ARGS();
3942 zval *src;
3943 size_t delta;
3944 uint32_t count;
3945 uint32_t type_flags = 0;
3946
3947 if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
3948 /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
3949 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3950 opline += first_extra_arg;
3951 #else
3952 EX(opline) += first_extra_arg;
3953 #endif
3954
3955 }
3956
3957 /* move extra args into separate array after all CV and TMP vars */
3958 src = EX_VAR_NUM(num_args - 1);
3959 delta = op_array->last_var + op_array->T - first_extra_arg;
3960 count = num_args - first_extra_arg;
3961 if (EXPECTED(delta != 0)) {
3962 delta *= sizeof(zval);
3963 do {
3964 type_flags |= Z_TYPE_INFO_P(src);
3965 ZVAL_COPY_VALUE((zval*)(((char*)src) + delta), src);
3966 ZVAL_UNDEF(src);
3967 src--;
3968 } while (--count);
3969 if (Z_TYPE_INFO_REFCOUNTED(type_flags)) {
3970 ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3971 }
3972 } else {
3973 do {
3974 if (Z_REFCOUNTED_P(src)) {
3975 ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3976 break;
3977 }
3978 src--;
3979 } while (--count);
3980 }
3981 }
3982
zend_init_cvs(uint32_t first,uint32_t last EXECUTE_DATA_DC)3983 static zend_always_inline void zend_init_cvs(uint32_t first, uint32_t last EXECUTE_DATA_DC)
3984 {
3985 if (EXPECTED(first < last)) {
3986 uint32_t count = last - first;
3987 zval *var = EX_VAR_NUM(first);
3988
3989 do {
3990 ZVAL_UNDEF(var);
3991 var++;
3992 } while (--count);
3993 }
3994 }
3995
i_init_func_execute_data(zend_op_array * op_array,zval * return_value,bool may_be_trampoline EXECUTE_DATA_DC)3996 static zend_always_inline void i_init_func_execute_data(zend_op_array *op_array, zval *return_value, bool may_be_trampoline EXECUTE_DATA_DC) /* {{{ */
3997 {
3998 uint32_t first_extra_arg, num_args;
3999 ZEND_ASSERT(EX(func) == (zend_function*)op_array);
4000
4001 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4002 opline = op_array->opcodes;
4003 #else
4004 EX(opline) = op_array->opcodes;
4005 #endif
4006 EX(call) = NULL;
4007 EX(return_value) = return_value;
4008
4009 /* Handle arguments */
4010 first_extra_arg = op_array->num_args;
4011 num_args = EX_NUM_ARGS();
4012 if (UNEXPECTED(num_args > first_extra_arg)) {
4013 if (!may_be_trampoline || EXPECTED(!(op_array->fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE))) {
4014 zend_copy_extra_args(EXECUTE_DATA_C);
4015 }
4016 } else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
4017 /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
4018 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4019 opline += num_args;
4020 #else
4021 EX(opline) += num_args;
4022 #endif
4023 }
4024
4025 /* Initialize CV variables (skip arguments) */
4026 zend_init_cvs(num_args, op_array->last_var EXECUTE_DATA_CC);
4027
4028 EX(run_time_cache) = RUN_TIME_CACHE(op_array);
4029
4030 EG(current_execute_data) = execute_data;
4031 }
4032 /* }}} */
4033
init_func_run_time_cache_i(zend_op_array * op_array)4034 static zend_always_inline void init_func_run_time_cache_i(zend_op_array *op_array) /* {{{ */
4035 {
4036 void **run_time_cache;
4037
4038 ZEND_ASSERT(RUN_TIME_CACHE(op_array) == NULL);
4039 run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
4040 memset(run_time_cache, 0, op_array->cache_size);
4041 ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
4042 }
4043 /* }}} */
4044
init_func_run_time_cache(zend_op_array * op_array)4045 static zend_never_inline void ZEND_FASTCALL init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
4046 {
4047 init_func_run_time_cache_i(op_array);
4048 }
4049 /* }}} */
4050
zend_fetch_function(zend_string * name)4051 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function(zend_string *name) /* {{{ */
4052 {
4053 zval *zv = zend_hash_find(EG(function_table), name);
4054
4055 if (EXPECTED(zv != NULL)) {
4056 zend_function *fbc = Z_FUNC_P(zv);
4057
4058 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4059 init_func_run_time_cache_i(&fbc->op_array);
4060 }
4061 return fbc;
4062 }
4063 return NULL;
4064 } /* }}} */
4065
zend_fetch_function_str(const char * name,size_t len)4066 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name, size_t len) /* {{{ */
4067 {
4068 zval *zv = zend_hash_str_find(EG(function_table), name, len);
4069
4070 if (EXPECTED(zv != NULL)) {
4071 zend_function *fbc = Z_FUNC_P(zv);
4072
4073 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4074 init_func_run_time_cache_i(&fbc->op_array);
4075 }
4076 return fbc;
4077 }
4078 return NULL;
4079 } /* }}} */
4080
zend_init_func_run_time_cache(zend_op_array * op_array)4081 ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
4082 {
4083 if (!RUN_TIME_CACHE(op_array)) {
4084 init_func_run_time_cache_i(op_array);
4085 }
4086 } /* }}} */
4087
i_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)4088 static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4089 {
4090 ZEND_ASSERT(EX(func) == (zend_function*)op_array);
4091
4092 EX(opline) = op_array->opcodes;
4093 EX(call) = NULL;
4094 EX(return_value) = return_value;
4095
4096 if (op_array->last_var) {
4097 zend_attach_symbol_table(execute_data);
4098 }
4099
4100 if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
4101 void *ptr;
4102
4103 ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
4104 ptr = emalloc(op_array->cache_size);
4105 ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
4106 memset(ptr, 0, op_array->cache_size);
4107 }
4108 EX(run_time_cache) = RUN_TIME_CACHE(op_array);
4109
4110 EG(current_execute_data) = execute_data;
4111 }
4112 /* }}} */
4113
zend_init_func_execute_data(zend_execute_data * ex,zend_op_array * op_array,zval * return_value)4114 ZEND_API void zend_init_func_execute_data(zend_execute_data *ex, zend_op_array *op_array, zval *return_value) /* {{{ */
4115 {
4116 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4117 zend_execute_data *orig_execute_data = execute_data;
4118 #endif
4119 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4120 const zend_op *orig_opline = opline;
4121 #endif
4122 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4123 execute_data = ex;
4124 #else
4125 zend_execute_data *execute_data = ex;
4126 #endif
4127
4128 EX(prev_execute_data) = EG(current_execute_data);
4129 if (!RUN_TIME_CACHE(op_array)) {
4130 init_func_run_time_cache(op_array);
4131 }
4132 i_init_func_execute_data(op_array, return_value, 1 EXECUTE_DATA_CC);
4133
4134 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4135 EX(opline) = opline;
4136 opline = orig_opline;
4137 #endif
4138 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4139 execute_data = orig_execute_data;
4140 #endif
4141 }
4142 /* }}} */
4143
zend_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)4144 ZEND_API void zend_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4145 {
4146 EX(prev_execute_data) = EG(current_execute_data);
4147 i_init_code_execute_data(execute_data, op_array, return_value);
4148 }
4149 /* }}} */
4150
zend_init_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)4151 ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4152 {
4153 if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
4154 zend_init_code_execute_data(execute_data, op_array, return_value);
4155 } else {
4156 zend_init_func_execute_data(execute_data, op_array, return_value);
4157 }
4158 }
4159 /* }}} */
4160
zend_vm_stack_copy_call_frame(zend_execute_data * call,uint32_t passed_args,uint32_t additional_args)4161 zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
4162 {
4163 zend_execute_data *new_call;
4164 int used_stack = (EG(vm_stack_top) - (zval*)call) + additional_args;
4165
4166 /* copy call frame into new stack segment */
4167 new_call = zend_vm_stack_extend(used_stack * sizeof(zval));
4168 *new_call = *call;
4169 ZEND_ADD_CALL_FLAG(new_call, ZEND_CALL_ALLOCATED);
4170
4171 if (passed_args) {
4172 zval *src = ZEND_CALL_ARG(call, 1);
4173 zval *dst = ZEND_CALL_ARG(new_call, 1);
4174 do {
4175 ZVAL_COPY_VALUE(dst, src);
4176 passed_args--;
4177 src++;
4178 dst++;
4179 } while (passed_args);
4180 }
4181
4182 /* delete old call_frame from previous stack segment */
4183 EG(vm_stack)->prev->top = (zval*)call;
4184
4185 /* delete previous stack segment if it became empty */
4186 if (UNEXPECTED(EG(vm_stack)->prev->top == ZEND_VM_STACK_ELEMENTS(EG(vm_stack)->prev))) {
4187 zend_vm_stack r = EG(vm_stack)->prev;
4188
4189 EG(vm_stack)->prev = r->prev;
4190 efree(r);
4191 }
4192
4193 return new_call;
4194 }
4195 /* }}} */
4196
zend_get_running_generator(EXECUTE_DATA_D)4197 static zend_always_inline zend_generator *zend_get_running_generator(EXECUTE_DATA_D) /* {{{ */
4198 {
4199 /* The generator object is stored in EX(return_value) */
4200 zend_generator *generator = (zend_generator *) EX(return_value);
4201 /* However control may currently be delegated to another generator.
4202 * That's the one we're interested in. */
4203 return generator;
4204 }
4205 /* }}} */
4206
zend_unfinished_calls_gc(zend_execute_data * execute_data,zend_execute_data * call,uint32_t op_num,zend_get_gc_buffer * buf)4207 ZEND_API void zend_unfinished_calls_gc(zend_execute_data *execute_data, zend_execute_data *call, uint32_t op_num, zend_get_gc_buffer *buf) /* {{{ */
4208 {
4209 zend_op *opline = EX(func)->op_array.opcodes + op_num;
4210 int level;
4211 int do_exit;
4212 uint32_t num_args;
4213
4214 if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
4215 opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
4216 opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
4217 opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
4218 opline->opcode == ZEND_INIT_USER_CALL ||
4219 opline->opcode == ZEND_INIT_METHOD_CALL ||
4220 opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
4221 opline->opcode == ZEND_NEW)) {
4222 ZEND_ASSERT(op_num);
4223 opline--;
4224 }
4225
4226 do {
4227 /* find the number of actually passed arguments */
4228 level = 0;
4229 do_exit = 0;
4230 num_args = ZEND_CALL_NUM_ARGS(call);
4231 do {
4232 switch (opline->opcode) {
4233 case ZEND_DO_FCALL:
4234 case ZEND_DO_ICALL:
4235 case ZEND_DO_UCALL:
4236 case ZEND_DO_FCALL_BY_NAME:
4237 case ZEND_CALLABLE_CONVERT:
4238 level++;
4239 break;
4240 case ZEND_INIT_FCALL:
4241 case ZEND_INIT_FCALL_BY_NAME:
4242 case ZEND_INIT_NS_FCALL_BY_NAME:
4243 case ZEND_INIT_DYNAMIC_CALL:
4244 case ZEND_INIT_USER_CALL:
4245 case ZEND_INIT_METHOD_CALL:
4246 case ZEND_INIT_STATIC_METHOD_CALL:
4247 case ZEND_NEW:
4248 if (level == 0) {
4249 num_args = 0;
4250 do_exit = 1;
4251 }
4252 level--;
4253 break;
4254 case ZEND_SEND_VAL:
4255 case ZEND_SEND_VAL_EX:
4256 case ZEND_SEND_VAR:
4257 case ZEND_SEND_VAR_EX:
4258 case ZEND_SEND_FUNC_ARG:
4259 case ZEND_SEND_REF:
4260 case ZEND_SEND_VAR_NO_REF:
4261 case ZEND_SEND_VAR_NO_REF_EX:
4262 case ZEND_SEND_USER:
4263 if (level == 0) {
4264 /* For named args, the number of arguments is up to date. */
4265 if (opline->op2_type != IS_CONST) {
4266 num_args = opline->op2.num;
4267 }
4268 do_exit = 1;
4269 }
4270 break;
4271 case ZEND_SEND_ARRAY:
4272 case ZEND_SEND_UNPACK:
4273 case ZEND_CHECK_UNDEF_ARGS:
4274 if (level == 0) {
4275 do_exit = 1;
4276 }
4277 break;
4278 }
4279 if (!do_exit) {
4280 opline--;
4281 }
4282 } while (!do_exit);
4283 if (call->prev_execute_data) {
4284 /* skip current call region */
4285 level = 0;
4286 do_exit = 0;
4287 do {
4288 switch (opline->opcode) {
4289 case ZEND_DO_FCALL:
4290 case ZEND_DO_ICALL:
4291 case ZEND_DO_UCALL:
4292 case ZEND_DO_FCALL_BY_NAME:
4293 case ZEND_CALLABLE_CONVERT:
4294 level++;
4295 break;
4296 case ZEND_INIT_FCALL:
4297 case ZEND_INIT_FCALL_BY_NAME:
4298 case ZEND_INIT_NS_FCALL_BY_NAME:
4299 case ZEND_INIT_DYNAMIC_CALL:
4300 case ZEND_INIT_USER_CALL:
4301 case ZEND_INIT_METHOD_CALL:
4302 case ZEND_INIT_STATIC_METHOD_CALL:
4303 case ZEND_NEW:
4304 if (level == 0) {
4305 do_exit = 1;
4306 }
4307 level--;
4308 break;
4309 }
4310 opline--;
4311 } while (!do_exit);
4312 }
4313
4314 if (EXPECTED(num_args > 0)) {
4315 zval *p = ZEND_CALL_ARG(call, 1);
4316 do {
4317 zend_get_gc_buffer_add_zval(buf, p);
4318 p++;
4319 } while (--num_args);
4320 }
4321 if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
4322 zend_get_gc_buffer_add_obj(buf, Z_OBJ(call->This));
4323 }
4324 if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4325 zval *val;
4326 ZEND_HASH_FOREACH_VAL(call->extra_named_params, val) {
4327 zend_get_gc_buffer_add_zval(buf, val);
4328 } ZEND_HASH_FOREACH_END();
4329 }
4330 if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
4331 zend_get_gc_buffer_add_obj(buf, ZEND_CLOSURE_OBJECT(call->func));
4332 }
4333
4334 call = call->prev_execute_data;
4335 } while (call);
4336 }
4337 /* }}} */
4338
cleanup_unfinished_calls(zend_execute_data * execute_data,uint32_t op_num)4339 static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
4340 {
4341 if (UNEXPECTED(EX(call))) {
4342 zend_execute_data *call = EX(call);
4343 zend_op *opline = EX(func)->op_array.opcodes + op_num;
4344 int level;
4345 int do_exit;
4346
4347 if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
4348 opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
4349 opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
4350 opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
4351 opline->opcode == ZEND_INIT_USER_CALL ||
4352 opline->opcode == ZEND_INIT_METHOD_CALL ||
4353 opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
4354 opline->opcode == ZEND_NEW)) {
4355 ZEND_ASSERT(op_num);
4356 opline--;
4357 }
4358
4359 do {
4360 /* If the exception was thrown during a function call there might be
4361 * arguments pushed to the stack that have to be dtor'ed. */
4362
4363 /* find the number of actually passed arguments */
4364 level = 0;
4365 do_exit = 0;
4366 do {
4367 switch (opline->opcode) {
4368 case ZEND_DO_FCALL:
4369 case ZEND_DO_ICALL:
4370 case ZEND_DO_UCALL:
4371 case ZEND_DO_FCALL_BY_NAME:
4372 case ZEND_CALLABLE_CONVERT:
4373 level++;
4374 break;
4375 case ZEND_INIT_FCALL:
4376 case ZEND_INIT_FCALL_BY_NAME:
4377 case ZEND_INIT_NS_FCALL_BY_NAME:
4378 case ZEND_INIT_DYNAMIC_CALL:
4379 case ZEND_INIT_USER_CALL:
4380 case ZEND_INIT_METHOD_CALL:
4381 case ZEND_INIT_STATIC_METHOD_CALL:
4382 case ZEND_NEW:
4383 if (level == 0) {
4384 ZEND_CALL_NUM_ARGS(call) = 0;
4385 do_exit = 1;
4386 }
4387 level--;
4388 break;
4389 case ZEND_SEND_VAL:
4390 case ZEND_SEND_VAL_EX:
4391 case ZEND_SEND_VAR:
4392 case ZEND_SEND_VAR_EX:
4393 case ZEND_SEND_FUNC_ARG:
4394 case ZEND_SEND_REF:
4395 case ZEND_SEND_VAR_NO_REF:
4396 case ZEND_SEND_VAR_NO_REF_EX:
4397 case ZEND_SEND_USER:
4398 if (level == 0) {
4399 /* For named args, the number of arguments is up to date. */
4400 if (opline->op2_type != IS_CONST) {
4401 ZEND_CALL_NUM_ARGS(call) = opline->op2.num;
4402 }
4403 do_exit = 1;
4404 }
4405 break;
4406 case ZEND_SEND_ARRAY:
4407 case ZEND_SEND_UNPACK:
4408 case ZEND_CHECK_UNDEF_ARGS:
4409 if (level == 0) {
4410 do_exit = 1;
4411 }
4412 break;
4413 }
4414 if (!do_exit) {
4415 opline--;
4416 }
4417 } while (!do_exit);
4418 if (call->prev_execute_data) {
4419 /* skip current call region */
4420 level = 0;
4421 do_exit = 0;
4422 do {
4423 switch (opline->opcode) {
4424 case ZEND_DO_FCALL:
4425 case ZEND_DO_ICALL:
4426 case ZEND_DO_UCALL:
4427 case ZEND_DO_FCALL_BY_NAME:
4428 case ZEND_CALLABLE_CONVERT:
4429 level++;
4430 break;
4431 case ZEND_INIT_FCALL:
4432 case ZEND_INIT_FCALL_BY_NAME:
4433 case ZEND_INIT_NS_FCALL_BY_NAME:
4434 case ZEND_INIT_DYNAMIC_CALL:
4435 case ZEND_INIT_USER_CALL:
4436 case ZEND_INIT_METHOD_CALL:
4437 case ZEND_INIT_STATIC_METHOD_CALL:
4438 case ZEND_NEW:
4439 if (level == 0) {
4440 do_exit = 1;
4441 }
4442 level--;
4443 break;
4444 }
4445 opline--;
4446 } while (!do_exit);
4447 }
4448
4449 zend_vm_stack_free_args(EX(call));
4450
4451 if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
4452 OBJ_RELEASE(Z_OBJ(call->This));
4453 }
4454 if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4455 zend_free_extra_named_params(call->extra_named_params);
4456 }
4457 if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
4458 zend_object_release(ZEND_CLOSURE_OBJECT(call->func));
4459 } else if (call->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4460 zend_string_release_ex(call->func->common.function_name, 0);
4461 zend_free_trampoline(call->func);
4462 }
4463
4464 EX(call) = call->prev_execute_data;
4465 zend_vm_stack_free_call_frame(call);
4466 call = EX(call);
4467 } while (call);
4468 }
4469 }
4470 /* }}} */
4471
find_live_range(const zend_op_array * op_array,uint32_t op_num,uint32_t var_num)4472 static const zend_live_range *find_live_range(const zend_op_array *op_array, uint32_t op_num, uint32_t var_num) /* {{{ */
4473 {
4474 int i;
4475 for (i = 0; i < op_array->last_live_range; i++) {
4476 const zend_live_range *range = &op_array->live_range[i];
4477 if (op_num >= range->start && op_num < range->end
4478 && var_num == (range->var & ~ZEND_LIVE_MASK)) {
4479 return range;
4480 }
4481 }
4482 return NULL;
4483 }
4484 /* }}} */
4485
cleanup_live_vars(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)4486 static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
4487 {
4488 int i;
4489
4490 for (i = 0; i < EX(func)->op_array.last_live_range; i++) {
4491 const zend_live_range *range = &EX(func)->op_array.live_range[i];
4492 if (range->start > op_num) {
4493 /* further blocks will not be relevant... */
4494 break;
4495 } else if (op_num < range->end) {
4496 if (!catch_op_num || catch_op_num >= range->end) {
4497 uint32_t kind = range->var & ZEND_LIVE_MASK;
4498 uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
4499 zval *var = EX_VAR(var_num);
4500
4501 if (kind == ZEND_LIVE_TMPVAR) {
4502 zval_ptr_dtor_nogc(var);
4503 } else if (kind == ZEND_LIVE_NEW) {
4504 zend_object *obj;
4505 ZEND_ASSERT(Z_TYPE_P(var) == IS_OBJECT);
4506 obj = Z_OBJ_P(var);
4507 zend_object_store_ctor_failed(obj);
4508 OBJ_RELEASE(obj);
4509 } else if (kind == ZEND_LIVE_LOOP) {
4510 if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
4511 zend_hash_iterator_del(Z_FE_ITER_P(var));
4512 }
4513 zval_ptr_dtor_nogc(var);
4514 } else if (kind == ZEND_LIVE_ROPE) {
4515 zend_string **rope = (zend_string **)var;
4516 zend_op *last = EX(func)->op_array.opcodes + op_num;
4517 while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT)
4518 || last->result.var != var_num) {
4519 ZEND_ASSERT(last >= EX(func)->op_array.opcodes);
4520 last--;
4521 }
4522 if (last->opcode == ZEND_ROPE_INIT) {
4523 zend_string_release_ex(*rope, 0);
4524 } else {
4525 int j = last->extended_value;
4526 do {
4527 zend_string_release_ex(rope[j], 0);
4528 } while (j--);
4529 }
4530 } else if (kind == ZEND_LIVE_SILENCE) {
4531 /* restore previous error_reporting value */
4532 if (E_HAS_ONLY_FATAL_ERRORS(EG(error_reporting))
4533 && !E_HAS_ONLY_FATAL_ERRORS(Z_LVAL_P(var))) {
4534 EG(error_reporting) = Z_LVAL_P(var);
4535 }
4536 }
4537 }
4538 }
4539 }
4540 }
4541 /* }}} */
4542
zend_cleanup_unfinished_execution(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)4543 ZEND_API void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
4544 cleanup_unfinished_calls(execute_data, op_num);
4545 cleanup_live_vars(execute_data, op_num, catch_op_num);
4546 }
4547
zend_unfinished_execution_gc(zend_execute_data * execute_data,zend_execute_data * call,zend_get_gc_buffer * gc_buffer)4548 ZEND_API ZEND_ATTRIBUTE_DEPRECATED HashTable *zend_unfinished_execution_gc(zend_execute_data *execute_data, zend_execute_data *call, zend_get_gc_buffer *gc_buffer)
4549 {
4550 bool suspended_by_yield = false;
4551
4552 if (Z_TYPE_INFO(EX(This)) & ZEND_CALL_GENERATOR) {
4553 ZEND_ASSERT(EX(return_value));
4554
4555 /* The generator object is stored in EX(return_value) */
4556 zend_generator *generator = (zend_generator*) EX(return_value);
4557 ZEND_ASSERT(execute_data == generator->execute_data);
4558
4559 suspended_by_yield = !(generator->flags & ZEND_GENERATOR_CURRENTLY_RUNNING);
4560 }
4561
4562 return zend_unfinished_execution_gc_ex(execute_data, call, gc_buffer, suspended_by_yield);
4563 }
4564
zend_unfinished_execution_gc_ex(zend_execute_data * execute_data,zend_execute_data * call,zend_get_gc_buffer * gc_buffer,bool suspended_by_yield)4565 ZEND_API HashTable *zend_unfinished_execution_gc_ex(zend_execute_data *execute_data, zend_execute_data *call, zend_get_gc_buffer *gc_buffer, bool suspended_by_yield)
4566 {
4567 if (!EX(func)) {
4568 return NULL;
4569 }
4570
4571 if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
4572 zend_get_gc_buffer_add_obj(gc_buffer, Z_OBJ(execute_data->This));
4573 }
4574
4575 if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
4576 zend_get_gc_buffer_add_obj(gc_buffer, ZEND_CLOSURE_OBJECT(EX(func)));
4577 }
4578
4579 if (!ZEND_USER_CODE(EX(func)->common.type)) {
4580 ZEND_ASSERT(!(EX_CALL_INFO() & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_HAS_EXTRA_NAMED_PARAMS)));
4581 return NULL;
4582 }
4583
4584 zend_op_array *op_array = &EX(func)->op_array;
4585
4586 if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
4587 uint32_t i, num_cvs = EX(func)->op_array.last_var;
4588 for (i = 0; i < num_cvs; i++) {
4589 zend_get_gc_buffer_add_zval(gc_buffer, EX_VAR_NUM(i));
4590 }
4591 }
4592
4593 if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
4594 zval *zv = EX_VAR_NUM(op_array->last_var + op_array->T);
4595 zval *end = zv + (EX_NUM_ARGS() - op_array->num_args);
4596 while (zv != end) {
4597 zend_get_gc_buffer_add_zval(gc_buffer, zv++);
4598 }
4599 }
4600
4601 if (EX_CALL_INFO() & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4602 zval extra_named_params;
4603 ZVAL_ARR(&extra_named_params, EX(extra_named_params));
4604 zend_get_gc_buffer_add_zval(gc_buffer, &extra_named_params);
4605 }
4606
4607 if (call) {
4608 uint32_t op_num;
4609 if (UNEXPECTED(execute_data->opline->opcode == ZEND_HANDLE_EXCEPTION)) {
4610 op_num = EG(opline_before_exception) - op_array->opcodes;
4611 } else {
4612 op_num = execute_data->opline - op_array->opcodes;
4613 }
4614 ZEND_ASSERT(op_num < op_array->last);
4615 if (suspended_by_yield) {
4616 /* When the execution was suspended by yield, EX(opline) points to
4617 * next opline to execute. Otherwise, it points to the opline that
4618 * suspended execution. */
4619 op_num--;
4620 ZEND_ASSERT(EX(func)->op_array.opcodes[op_num].opcode == ZEND_YIELD
4621 || EX(func)->op_array.opcodes[op_num].opcode == ZEND_YIELD_FROM);
4622 }
4623 zend_unfinished_calls_gc(execute_data, call, op_num, gc_buffer);
4624 }
4625
4626 if (execute_data->opline != op_array->opcodes) {
4627 uint32_t i, op_num = execute_data->opline - op_array->opcodes - 1;
4628 for (i = 0; i < op_array->last_live_range; i++) {
4629 const zend_live_range *range = &op_array->live_range[i];
4630 if (range->start > op_num) {
4631 break;
4632 } else if (op_num < range->end) {
4633 uint32_t kind = range->var & ZEND_LIVE_MASK;
4634 uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
4635 zval *var = EX_VAR(var_num);
4636 if (kind == ZEND_LIVE_TMPVAR || kind == ZEND_LIVE_LOOP) {
4637 zend_get_gc_buffer_add_zval(gc_buffer, var);
4638 }
4639 }
4640 }
4641 }
4642
4643 if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
4644 return execute_data->symbol_table;
4645 } else {
4646 return NULL;
4647 }
4648 }
4649
4650 #if ZEND_VM_SPEC
zend_swap_operands(zend_op * op)4651 static void zend_swap_operands(zend_op *op) /* {{{ */
4652 {
4653 znode_op tmp;
4654 uint8_t tmp_type;
4655
4656 tmp = op->op1;
4657 tmp_type = op->op1_type;
4658 op->op1 = op->op2;
4659 op->op1_type = op->op2_type;
4660 op->op2 = tmp;
4661 op->op2_type = tmp_type;
4662 }
4663 /* }}} */
4664 #endif
4665
zend_init_dynamic_call_string(zend_string * function,uint32_t num_args)4666 static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_string *function, uint32_t num_args) /* {{{ */
4667 {
4668 zend_function *fbc;
4669 zval *func;
4670 zend_class_entry *called_scope;
4671 zend_string *lcname;
4672 const char *colon;
4673
4674 if ((colon = zend_memrchr(ZSTR_VAL(function), ':', ZSTR_LEN(function))) != NULL &&
4675 colon > ZSTR_VAL(function) &&
4676 *(colon-1) == ':'
4677 ) {
4678 zend_string *mname;
4679 size_t cname_length = colon - ZSTR_VAL(function) - 1;
4680 size_t mname_length = ZSTR_LEN(function) - cname_length - (sizeof("::") - 1);
4681
4682 lcname = zend_string_init(ZSTR_VAL(function), cname_length, 0);
4683
4684 called_scope = zend_fetch_class_by_name(lcname, NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4685 if (UNEXPECTED(called_scope == NULL)) {
4686 zend_string_release_ex(lcname, 0);
4687 return NULL;
4688 }
4689
4690 mname = zend_string_init(ZSTR_VAL(function) + (cname_length + sizeof("::") - 1), mname_length, 0);
4691
4692 if (called_scope->get_static_method) {
4693 fbc = called_scope->get_static_method(called_scope, mname);
4694 } else {
4695 fbc = zend_std_get_static_method(called_scope, mname, NULL);
4696 }
4697 if (UNEXPECTED(fbc == NULL)) {
4698 if (EXPECTED(!EG(exception))) {
4699 zend_undefined_method(called_scope, mname);
4700 }
4701 zend_string_release_ex(lcname, 0);
4702 zend_string_release_ex(mname, 0);
4703 return NULL;
4704 }
4705
4706 zend_string_release_ex(lcname, 0);
4707 zend_string_release_ex(mname, 0);
4708
4709 if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
4710 zend_non_static_method_call(fbc);
4711 if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4712 zend_string_release_ex(fbc->common.function_name, 0);
4713 zend_free_trampoline(fbc);
4714 }
4715 return NULL;
4716 }
4717 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4718 init_func_run_time_cache(&fbc->op_array);
4719 }
4720 } else {
4721 if (ZSTR_VAL(function)[0] == '\\') {
4722 lcname = zend_string_alloc(ZSTR_LEN(function) - 1, 0);
4723 zend_str_tolower_copy(ZSTR_VAL(lcname), ZSTR_VAL(function) + 1, ZSTR_LEN(function) - 1);
4724 } else {
4725 lcname = zend_string_tolower(function);
4726 }
4727 if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {
4728 zend_throw_error(NULL, "Call to undefined function %s()", ZSTR_VAL(function));
4729 zend_string_release_ex(lcname, 0);
4730 return NULL;
4731 }
4732 zend_string_release_ex(lcname, 0);
4733
4734 fbc = Z_FUNC_P(func);
4735 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4736 init_func_run_time_cache(&fbc->op_array);
4737 }
4738 called_scope = NULL;
4739 }
4740
4741 return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC,
4742 fbc, num_args, called_scope);
4743 }
4744 /* }}} */
4745
zend_init_dynamic_call_object(zend_object * function,uint32_t num_args)4746 static zend_never_inline zend_execute_data *zend_init_dynamic_call_object(zend_object *function, uint32_t num_args) /* {{{ */
4747 {
4748 zend_function *fbc;
4749 void *object_or_called_scope;
4750 zend_class_entry *called_scope;
4751 zend_object *object;
4752 uint32_t call_info;
4753
4754 if (EXPECTED(function->handlers->get_closure) &&
4755 EXPECTED(function->handlers->get_closure(function, &called_scope, &fbc, &object, 0) == SUCCESS)) {
4756
4757 object_or_called_scope = called_scope;
4758 if (EXPECTED(fbc->common.fn_flags & ZEND_ACC_CLOSURE)) {
4759 /* Delay closure destruction until its invocation */
4760 GC_ADDREF(ZEND_CLOSURE_OBJECT(fbc));
4761 ZEND_ASSERT(ZEND_ACC_FAKE_CLOSURE == ZEND_CALL_FAKE_CLOSURE);
4762 call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC | ZEND_CALL_CLOSURE |
4763 (fbc->common.fn_flags & ZEND_ACC_FAKE_CLOSURE);
4764 if (object) {
4765 call_info |= ZEND_CALL_HAS_THIS;
4766 object_or_called_scope = object;
4767 }
4768 } else {
4769 call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4770 if (object) {
4771 call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4772 GC_ADDREF(object); /* For $this pointer */
4773 object_or_called_scope = object;
4774 }
4775 }
4776 } else {
4777 zend_throw_error(NULL, "Object of type %s is not callable", ZSTR_VAL(function->ce->name));
4778 return NULL;
4779 }
4780
4781 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4782 init_func_run_time_cache(&fbc->op_array);
4783 }
4784
4785 return zend_vm_stack_push_call_frame(call_info,
4786 fbc, num_args, object_or_called_scope);
4787 }
4788 /* }}} */
4789
zend_init_dynamic_call_array(zend_array * function,uint32_t num_args)4790 static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_array *function, uint32_t num_args) /* {{{ */
4791 {
4792 zend_function *fbc;
4793 void *object_or_called_scope;
4794 uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4795
4796 if (zend_hash_num_elements(function) == 2) {
4797 zval *obj;
4798 zval *method;
4799 obj = zend_hash_index_find(function, 0);
4800 method = zend_hash_index_find(function, 1);
4801
4802 if (UNEXPECTED(!obj) || UNEXPECTED(!method)) {
4803 zend_throw_error(NULL, "Array callback has to contain indices 0 and 1");
4804 return NULL;
4805 }
4806
4807 ZVAL_DEREF(obj);
4808 if (UNEXPECTED(Z_TYPE_P(obj) != IS_STRING) && UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
4809 zend_throw_error(NULL, "First array member is not a valid class name or object");
4810 return NULL;
4811 }
4812
4813 ZVAL_DEREF(method);
4814 if (UNEXPECTED(Z_TYPE_P(method) != IS_STRING)) {
4815 zend_throw_error(NULL, "Second array member is not a valid method");
4816 return NULL;
4817 }
4818
4819 if (Z_TYPE_P(obj) == IS_STRING) {
4820 zend_class_entry *called_scope = zend_fetch_class_by_name(Z_STR_P(obj), NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4821
4822 if (UNEXPECTED(called_scope == NULL)) {
4823 return NULL;
4824 }
4825
4826 if (called_scope->get_static_method) {
4827 fbc = called_scope->get_static_method(called_scope, Z_STR_P(method));
4828 } else {
4829 fbc = zend_std_get_static_method(called_scope, Z_STR_P(method), NULL);
4830 }
4831 if (UNEXPECTED(fbc == NULL)) {
4832 if (EXPECTED(!EG(exception))) {
4833 zend_undefined_method(called_scope, Z_STR_P(method));
4834 }
4835 return NULL;
4836 }
4837 if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
4838 zend_non_static_method_call(fbc);
4839 if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4840 zend_string_release_ex(fbc->common.function_name, 0);
4841 zend_free_trampoline(fbc);
4842 }
4843 return NULL;
4844 }
4845 object_or_called_scope = called_scope;
4846 } else {
4847 zend_object *object = Z_OBJ_P(obj);
4848
4849 fbc = Z_OBJ_HT_P(obj)->get_method(&object, Z_STR_P(method), NULL);
4850 if (UNEXPECTED(fbc == NULL)) {
4851 if (EXPECTED(!EG(exception))) {
4852 zend_undefined_method(object->ce, Z_STR_P(method));
4853 }
4854 return NULL;
4855 }
4856
4857 if ((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
4858 object_or_called_scope = object->ce;
4859 } else {
4860 call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4861 GC_ADDREF(object); /* For $this pointer */
4862 object_or_called_scope = object;
4863 }
4864 }
4865 } else {
4866 zend_throw_error(NULL, "Array callback must have exactly two elements");
4867 return NULL;
4868 }
4869
4870 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4871 init_func_run_time_cache(&fbc->op_array);
4872 }
4873
4874 return zend_vm_stack_push_call_frame(call_info,
4875 fbc, num_args, object_or_called_scope);
4876 }
4877 /* }}} */
4878
4879 #define ZEND_FAKE_OP_ARRAY ((zend_op_array*)(intptr_t)-1)
4880
zend_include_or_eval(zval * inc_filename_zv,int type)4881 static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval *inc_filename_zv, int type) /* {{{ */
4882 {
4883 zend_op_array *new_op_array = NULL;
4884 zend_string *tmp_inc_filename;
4885 zend_string *inc_filename = zval_try_get_tmp_string(inc_filename_zv, &tmp_inc_filename);
4886 if (UNEXPECTED(!inc_filename)) {
4887 return NULL;
4888 }
4889
4890 switch (type) {
4891 case ZEND_INCLUDE_ONCE:
4892 case ZEND_REQUIRE_ONCE: {
4893 zend_file_handle file_handle;
4894 zend_string *resolved_path;
4895
4896 resolved_path = zend_resolve_path(inc_filename);
4897 if (EXPECTED(resolved_path)) {
4898 if (zend_hash_exists(&EG(included_files), resolved_path)) {
4899 new_op_array = ZEND_FAKE_OP_ARRAY;
4900 zend_string_release_ex(resolved_path, 0);
4901 break;
4902 }
4903 } else if (UNEXPECTED(EG(exception))) {
4904 break;
4905 } else if (UNEXPECTED(strlen(ZSTR_VAL(inc_filename)) != ZSTR_LEN(inc_filename))) {
4906 zend_message_dispatcher(
4907 (type == ZEND_INCLUDE_ONCE) ?
4908 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4909 ZSTR_VAL(inc_filename));
4910 break;
4911 } else {
4912 resolved_path = zend_string_copy(inc_filename);
4913 }
4914
4915 zend_stream_init_filename_ex(&file_handle, resolved_path);
4916 if (SUCCESS == zend_stream_open(&file_handle)) {
4917
4918 if (!file_handle.opened_path) {
4919 file_handle.opened_path = zend_string_copy(resolved_path);
4920 }
4921
4922 if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path)) {
4923 new_op_array = zend_compile_file(&file_handle, (type==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE));
4924 } else {
4925 new_op_array = ZEND_FAKE_OP_ARRAY;
4926 }
4927 } else if (!EG(exception)) {
4928 zend_message_dispatcher(
4929 (type == ZEND_INCLUDE_ONCE) ?
4930 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4931 ZSTR_VAL(inc_filename));
4932 }
4933 zend_destroy_file_handle(&file_handle);
4934 zend_string_release_ex(resolved_path, 0);
4935 }
4936 break;
4937 case ZEND_INCLUDE:
4938 case ZEND_REQUIRE:
4939 if (UNEXPECTED(strlen(ZSTR_VAL(inc_filename)) != ZSTR_LEN(inc_filename))) {
4940 zend_message_dispatcher(
4941 (type == ZEND_INCLUDE) ?
4942 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4943 ZSTR_VAL(inc_filename));
4944 break;
4945 }
4946 new_op_array = compile_filename(type, inc_filename);
4947 break;
4948 case ZEND_EVAL: {
4949 char *eval_desc = zend_make_compiled_string_description("eval()'d code");
4950 new_op_array = zend_compile_string(inc_filename, eval_desc, ZEND_COMPILE_POSITION_AFTER_OPEN_TAG);
4951 efree(eval_desc);
4952 }
4953 break;
4954 EMPTY_SWITCH_DEFAULT_CASE()
4955 }
4956
4957 zend_tmp_string_release(tmp_inc_filename);
4958 return new_op_array;
4959 }
4960 /* }}} */
4961
zend_fe_reset_iterator(zval * array_ptr,int by_ref OPLINE_DC EXECUTE_DATA_DC)4962 static zend_never_inline bool ZEND_FASTCALL zend_fe_reset_iterator(zval *array_ptr, int by_ref OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4963 {
4964 zend_class_entry *ce = Z_OBJCE_P(array_ptr);
4965 zend_object_iterator *iter = ce->get_iterator(ce, array_ptr, by_ref);
4966 bool is_empty;
4967
4968 if (UNEXPECTED(!iter) || UNEXPECTED(EG(exception))) {
4969 if (iter) {
4970 OBJ_RELEASE(&iter->std);
4971 }
4972 if (!EG(exception)) {
4973 zend_throw_exception_ex(NULL, 0, "Object of type %s did not create an Iterator", ZSTR_VAL(ce->name));
4974 }
4975 ZVAL_UNDEF(EX_VAR(opline->result.var));
4976 return 1;
4977 }
4978
4979 iter->index = 0;
4980 if (iter->funcs->rewind) {
4981 iter->funcs->rewind(iter);
4982 if (UNEXPECTED(EG(exception) != NULL)) {
4983 OBJ_RELEASE(&iter->std);
4984 ZVAL_UNDEF(EX_VAR(opline->result.var));
4985 return 1;
4986 }
4987 }
4988
4989 is_empty = iter->funcs->valid(iter) != SUCCESS;
4990
4991 if (UNEXPECTED(EG(exception) != NULL)) {
4992 OBJ_RELEASE(&iter->std);
4993 ZVAL_UNDEF(EX_VAR(opline->result.var));
4994 return 1;
4995 }
4996 iter->index = -1; /* will be set to 0 before using next handler */
4997
4998 ZVAL_OBJ(EX_VAR(opline->result.var), &iter->std);
4999 Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
5000
5001 return is_empty;
5002 }
5003 /* }}} */
5004
_zend_quick_get_constant(const zval * key,uint32_t flags,bool check_defined_only OPLINE_DC EXECUTE_DATA_DC)5005 static zend_always_inline zend_result _zend_quick_get_constant(
5006 const zval *key, uint32_t flags, bool check_defined_only OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5007 {
5008 zval *zv;
5009 zend_constant *c = NULL;
5010
5011 /* null/true/false are resolved during compilation, so don't check for them here. */
5012 zv = zend_hash_find_known_hash(EG(zend_constants), Z_STR_P(key));
5013 if (zv) {
5014 c = (zend_constant*)Z_PTR_P(zv);
5015 } else if (flags & IS_CONSTANT_UNQUALIFIED_IN_NAMESPACE) {
5016 key++;
5017 zv = zend_hash_find_known_hash(EG(zend_constants), Z_STR_P(key));
5018 if (zv) {
5019 c = (zend_constant*)Z_PTR_P(zv);
5020 }
5021 }
5022
5023 if (!c) {
5024 if (!check_defined_only) {
5025 zend_throw_error(NULL, "Undefined constant \"%s\"", Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
5026 ZVAL_UNDEF(EX_VAR(opline->result.var));
5027 }
5028 return FAILURE;
5029 }
5030
5031 if (!check_defined_only) {
5032 ZVAL_COPY_OR_DUP(EX_VAR(opline->result.var), &c->value);
5033 if (ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED) {
5034 zend_error(E_DEPRECATED, "Constant %s is deprecated", ZSTR_VAL(c->name));
5035 return SUCCESS;
5036 }
5037 }
5038
5039 CACHE_PTR(opline->extended_value, c);
5040 return SUCCESS;
5041 }
5042 /* }}} */
5043
zend_quick_get_constant(const zval * key,uint32_t flags OPLINE_DC EXECUTE_DATA_DC)5044 static zend_never_inline void ZEND_FASTCALL zend_quick_get_constant(
5045 const zval *key, uint32_t flags OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5046 {
5047 _zend_quick_get_constant(key, flags, 0 OPLINE_CC EXECUTE_DATA_CC);
5048 } /* }}} */
5049
zend_quick_check_constant(const zval * key OPLINE_DC EXECUTE_DATA_DC)5050 static zend_never_inline zend_result ZEND_FASTCALL zend_quick_check_constant(
5051 const zval *key OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5052 {
5053 return _zend_quick_get_constant(key, 0, 1 OPLINE_CC EXECUTE_DATA_CC);
5054 } /* }}} */
5055
zend_get_arg_offset_by_name(zend_function * fbc,zend_string * arg_name,void ** cache_slot)5056 static zend_always_inline uint32_t zend_get_arg_offset_by_name(
5057 zend_function *fbc, zend_string *arg_name, void **cache_slot) {
5058 if (EXPECTED(*cache_slot == fbc)) {
5059 return *(uintptr_t *)(cache_slot + 1);
5060 }
5061
5062 // TODO: Use a hash table?
5063 uint32_t num_args = fbc->common.num_args;
5064 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION)
5065 || EXPECTED(fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO)) {
5066 for (uint32_t i = 0; i < num_args; i++) {
5067 zend_arg_info *arg_info = &fbc->op_array.arg_info[i];
5068 if (zend_string_equals(arg_name, arg_info->name)) {
5069 *cache_slot = fbc;
5070 *(uintptr_t *)(cache_slot + 1) = i;
5071 return i;
5072 }
5073 }
5074 } else {
5075 for (uint32_t i = 0; i < num_args; i++) {
5076 zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
5077 size_t len = strlen(arg_info->name);
5078 if (zend_string_equals_cstr(arg_name, arg_info->name, len)) {
5079 *cache_slot = fbc;
5080 *(uintptr_t *)(cache_slot + 1) = i;
5081 return i;
5082 }
5083 }
5084 }
5085
5086 if (fbc->common.fn_flags & ZEND_ACC_VARIADIC) {
5087 *cache_slot = fbc;
5088 *(uintptr_t *)(cache_slot + 1) = fbc->common.num_args;
5089 return fbc->common.num_args;
5090 }
5091
5092 return (uint32_t) -1;
5093 }
5094
zend_handle_named_arg(zend_execute_data ** call_ptr,zend_string * arg_name,uint32_t * arg_num_ptr,void ** cache_slot)5095 zval * ZEND_FASTCALL zend_handle_named_arg(
5096 zend_execute_data **call_ptr, zend_string *arg_name,
5097 uint32_t *arg_num_ptr, void **cache_slot) {
5098 zend_execute_data *call = *call_ptr;
5099 zend_function *fbc = call->func;
5100 uint32_t arg_offset = zend_get_arg_offset_by_name(fbc, arg_name, cache_slot);
5101 if (UNEXPECTED(arg_offset == (uint32_t) -1)) {
5102 zend_throw_error(NULL, "Unknown named parameter $%s", ZSTR_VAL(arg_name));
5103 return NULL;
5104 }
5105
5106 zval *arg;
5107 if (UNEXPECTED(arg_offset == fbc->common.num_args)) {
5108 /* Unknown named parameter that will be collected into a variadic. */
5109 if (!(ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS)) {
5110 ZEND_ADD_CALL_FLAG(call, ZEND_CALL_HAS_EXTRA_NAMED_PARAMS);
5111 call->extra_named_params = zend_new_array(0);
5112 }
5113
5114 arg = zend_hash_add_empty_element(call->extra_named_params, arg_name);
5115 if (!arg) {
5116 zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
5117 ZSTR_VAL(arg_name));
5118 return NULL;
5119 }
5120 *arg_num_ptr = arg_offset + 1;
5121 return arg;
5122 }
5123
5124 uint32_t current_num_args = ZEND_CALL_NUM_ARGS(call);
5125 // TODO: We may wish to optimize the arg_offset == current_num_args case,
5126 // which is probably common (if the named parameters are in order of declaration).
5127 if (arg_offset >= current_num_args) {
5128 uint32_t new_num_args = arg_offset + 1;
5129 ZEND_CALL_NUM_ARGS(call) = new_num_args;
5130
5131 uint32_t num_extra_args = new_num_args - current_num_args;
5132 zend_vm_stack_extend_call_frame(call_ptr, current_num_args, num_extra_args);
5133 call = *call_ptr;
5134
5135 arg = ZEND_CALL_VAR_NUM(call, arg_offset);
5136 if (num_extra_args > 1) {
5137 zval *zv = ZEND_CALL_VAR_NUM(call, current_num_args);
5138 do {
5139 ZVAL_UNDEF(zv);
5140 zv++;
5141 } while (zv != arg);
5142 ZEND_ADD_CALL_FLAG(call, ZEND_CALL_MAY_HAVE_UNDEF);
5143 }
5144 } else {
5145 arg = ZEND_CALL_VAR_NUM(call, arg_offset);
5146 if (UNEXPECTED(!Z_ISUNDEF_P(arg))) {
5147 zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
5148 ZSTR_VAL(arg_name));
5149 return NULL;
5150 }
5151 }
5152
5153 *arg_num_ptr = arg_offset + 1;
5154 return arg;
5155 }
5156
start_fake_frame(zend_execute_data * call,const zend_op * opline)5157 static zend_execute_data *start_fake_frame(zend_execute_data *call, const zend_op *opline) {
5158 zend_execute_data *old_prev_execute_data = call->prev_execute_data;
5159 call->prev_execute_data = EG(current_execute_data);
5160 call->opline = opline;
5161 EG(current_execute_data) = call;
5162 return old_prev_execute_data;
5163 }
5164
end_fake_frame(zend_execute_data * call,zend_execute_data * old_prev_execute_data)5165 static void end_fake_frame(zend_execute_data *call, zend_execute_data *old_prev_execute_data) {
5166 zend_execute_data *prev_execute_data = call->prev_execute_data;
5167 EG(current_execute_data) = prev_execute_data;
5168 call->prev_execute_data = old_prev_execute_data;
5169 if (UNEXPECTED(EG(exception)) && ZEND_USER_CODE(prev_execute_data->func->common.type)) {
5170 zend_rethrow_exception(prev_execute_data);
5171 }
5172 }
5173
zend_handle_undef_args(zend_execute_data * call)5174 ZEND_API zend_result ZEND_FASTCALL zend_handle_undef_args(zend_execute_data *call) {
5175 zend_function *fbc = call->func;
5176 if (fbc->type == ZEND_USER_FUNCTION) {
5177 zend_op_array *op_array = &fbc->op_array;
5178 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
5179 for (uint32_t i = 0; i < num_args; i++) {
5180 zval *arg = ZEND_CALL_VAR_NUM(call, i);
5181 if (!Z_ISUNDEF_P(arg)) {
5182 continue;
5183 }
5184
5185 zend_op *opline = &op_array->opcodes[i];
5186 if (EXPECTED(opline->opcode == ZEND_RECV_INIT)) {
5187 zval *default_value = RT_CONSTANT(opline, opline->op2);
5188 if (Z_OPT_TYPE_P(default_value) == IS_CONSTANT_AST) {
5189 if (UNEXPECTED(!RUN_TIME_CACHE(op_array))) {
5190 init_func_run_time_cache(op_array);
5191 }
5192
5193 void *run_time_cache = RUN_TIME_CACHE(op_array);
5194 zval *cache_val =
5195 (zval *) ((char *) run_time_cache + Z_CACHE_SLOT_P(default_value));
5196
5197 if (Z_TYPE_P(cache_val) != IS_UNDEF) {
5198 /* We keep in cache only not refcounted values */
5199 ZVAL_COPY_VALUE(arg, cache_val);
5200 } else {
5201 /* Update constant inside a temporary zval, to make sure the CONSTANT_AST
5202 * value is not accessible through back traces. */
5203 zval tmp;
5204 ZVAL_COPY(&tmp, default_value);
5205 zend_execute_data *old = start_fake_frame(call, opline);
5206 zend_result ret = zval_update_constant_ex(&tmp, fbc->op_array.scope);
5207 end_fake_frame(call, old);
5208 if (UNEXPECTED(ret == FAILURE)) {
5209 zval_ptr_dtor_nogc(&tmp);
5210 return FAILURE;
5211 }
5212 ZVAL_COPY_VALUE(arg, &tmp);
5213 if (!Z_REFCOUNTED(tmp)) {
5214 ZVAL_COPY_VALUE(cache_val, &tmp);
5215 }
5216 }
5217 } else {
5218 ZVAL_COPY(arg, default_value);
5219 }
5220 } else {
5221 ZEND_ASSERT(opline->opcode == ZEND_RECV);
5222 zend_execute_data *old = start_fake_frame(call, opline);
5223 zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
5224 end_fake_frame(call, old);
5225 return FAILURE;
5226 }
5227 }
5228
5229 return SUCCESS;
5230 } else {
5231 if (fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO) {
5232 /* Magic function, let it deal with it. */
5233 return SUCCESS;
5234 }
5235
5236 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
5237 for (uint32_t i = 0; i < num_args; i++) {
5238 zval *arg = ZEND_CALL_VAR_NUM(call, i);
5239 if (!Z_ISUNDEF_P(arg)) {
5240 continue;
5241 }
5242
5243 zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
5244 if (i < fbc->common.required_num_args) {
5245 zend_execute_data *old = start_fake_frame(call, NULL);
5246 zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
5247 end_fake_frame(call, old);
5248 return FAILURE;
5249 }
5250
5251 zval default_value;
5252 if (zend_get_default_from_internal_arg_info(&default_value, arg_info) == FAILURE) {
5253 zend_execute_data *old = start_fake_frame(call, NULL);
5254 zend_argument_error(zend_ce_argument_count_error, i + 1,
5255 "must be passed explicitly, because the default value is not known");
5256 end_fake_frame(call, old);
5257 return FAILURE;
5258 }
5259
5260 if (Z_TYPE(default_value) == IS_CONSTANT_AST) {
5261 zend_execute_data *old = start_fake_frame(call, NULL);
5262 zend_result ret = zval_update_constant_ex(&default_value, fbc->common.scope);
5263 end_fake_frame(call, old);
5264 if (ret == FAILURE) {
5265 return FAILURE;
5266 }
5267 }
5268
5269 ZVAL_COPY_VALUE(arg, &default_value);
5270 if (ZEND_ARG_SEND_MODE(arg_info) & ZEND_SEND_BY_REF) {
5271 ZVAL_NEW_REF(arg, arg);
5272 }
5273 }
5274 }
5275
5276 return SUCCESS;
5277 }
5278
zend_free_extra_named_params(zend_array * extra_named_params)5279 ZEND_API void ZEND_FASTCALL zend_free_extra_named_params(zend_array *extra_named_params)
5280 {
5281 /* Extra named params may be shared. */
5282 zend_array_release(extra_named_params);
5283 }
5284
5285 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
5286 /* Special versions of functions that sets EX(opline) before calling zend_vm_stack_extend() */
_zend_vm_stack_push_call_frame_ex(uint32_t used_stack,uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)5287 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame_ex(uint32_t used_stack, uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
5288 {
5289 zend_execute_data *call = (zend_execute_data*)EG(vm_stack_top);
5290
5291 ZEND_ASSERT_VM_STACK_GLOBAL;
5292
5293 if (UNEXPECTED(used_stack > (size_t)(((char*)EG(vm_stack_end)) - (char*)call))) {
5294 EX(opline) = opline; /* this is the only difference */
5295 call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
5296 ZEND_ASSERT_VM_STACK_GLOBAL;
5297 zend_vm_init_call_frame(call, call_info | ZEND_CALL_ALLOCATED, func, num_args, object_or_called_scope);
5298 return call;
5299 } else {
5300 EG(vm_stack_top) = (zval*)((char*)call + used_stack);
5301 zend_vm_init_call_frame(call, call_info, func, num_args, object_or_called_scope);
5302 return call;
5303 }
5304 } /* }}} */
5305
_zend_vm_stack_push_call_frame(uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)5306 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame(uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
5307 {
5308 uint32_t used_stack = zend_vm_calc_used_stack(num_args, func);
5309
5310 return _zend_vm_stack_push_call_frame_ex(used_stack, call_info,
5311 func, num_args, object_or_called_scope);
5312 } /* }}} */
5313 #else
5314 # define _zend_vm_stack_push_call_frame_ex zend_vm_stack_push_call_frame_ex
5315 # define _zend_vm_stack_push_call_frame zend_vm_stack_push_call_frame
5316 #endif
5317
5318 #ifdef ZEND_VM_TRACE_HANDLERS
5319 # include "zend_vm_trace_handlers.h"
5320 #elif defined(ZEND_VM_TRACE_LINES)
5321 # include "zend_vm_trace_lines.h"
5322 #elif defined(ZEND_VM_TRACE_MAP)
5323 # include "zend_vm_trace_map.h"
5324 #endif
5325
5326 #define ZEND_VM_NEXT_OPCODE_EX(check_exception, skip) \
5327 CHECK_SYMBOL_TABLES() \
5328 if (check_exception) { \
5329 OPLINE = EX(opline) + (skip); \
5330 } else { \
5331 ZEND_ASSERT(!EG(exception)); \
5332 OPLINE = opline + (skip); \
5333 } \
5334 ZEND_VM_CONTINUE()
5335
5336 #define ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION() \
5337 ZEND_VM_NEXT_OPCODE_EX(1, 1)
5338
5339 #define ZEND_VM_NEXT_OPCODE() \
5340 ZEND_VM_NEXT_OPCODE_EX(0, 1)
5341
5342 #define ZEND_VM_SET_NEXT_OPCODE(new_op) \
5343 CHECK_SYMBOL_TABLES() \
5344 OPLINE = new_op
5345
5346 #define ZEND_VM_SET_OPCODE(new_op) \
5347 CHECK_SYMBOL_TABLES() \
5348 OPLINE = new_op; \
5349 ZEND_VM_INTERRUPT_CHECK()
5350
5351 #define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
5352 ZEND_VM_SET_OPCODE(ZEND_OFFSET_TO_OPLINE(opline, offset))
5353
5354 #define ZEND_VM_JMP_EX(new_op, check_exception) do { \
5355 if (check_exception && UNEXPECTED(EG(exception))) { \
5356 HANDLE_EXCEPTION(); \
5357 } \
5358 ZEND_VM_SET_OPCODE(new_op); \
5359 ZEND_VM_CONTINUE(); \
5360 } while (0)
5361
5362 #define ZEND_VM_JMP(new_op) \
5363 ZEND_VM_JMP_EX(new_op, 1)
5364
5365 #define ZEND_VM_INC_OPCODE() \
5366 OPLINE++
5367
5368
5369 #define ZEND_VM_REPEATABLE_OPCODE \
5370 do {
5371 #define ZEND_VM_REPEAT_OPCODE(_opcode) \
5372 } while (UNEXPECTED((++opline)->opcode == _opcode)); \
5373 OPLINE = opline; \
5374 ZEND_VM_CONTINUE()
5375 #define ZEND_VM_SMART_BRANCH(_result, _check) do { \
5376 if ((_check) && UNEXPECTED(EG(exception))) { \
5377 OPLINE = EX(opline); \
5378 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5379 if (_result) { \
5380 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5381 } else { \
5382 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5383 } \
5384 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5385 if (!(_result)) { \
5386 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5387 } else { \
5388 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5389 } \
5390 } else { \
5391 ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
5392 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5393 } \
5394 ZEND_VM_CONTINUE(); \
5395 } while (0)
5396 #define ZEND_VM_SMART_BRANCH_JMPZ(_result, _check) do { \
5397 if ((_check) && UNEXPECTED(EG(exception))) { \
5398 OPLINE = EX(opline); \
5399 } else if (_result) { \
5400 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5401 } else { \
5402 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5403 } \
5404 ZEND_VM_CONTINUE(); \
5405 } while (0)
5406 #define ZEND_VM_SMART_BRANCH_JMPNZ(_result, _check) do { \
5407 if ((_check) && UNEXPECTED(EG(exception))) { \
5408 OPLINE = EX(opline); \
5409 } else if (!(_result)) { \
5410 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5411 } else { \
5412 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5413 } \
5414 ZEND_VM_CONTINUE(); \
5415 } while (0)
5416 #define ZEND_VM_SMART_BRANCH_NONE(_result, _check) do { \
5417 ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
5418 ZEND_VM_NEXT_OPCODE_EX(_check, 1); \
5419 ZEND_VM_CONTINUE(); \
5420 } while (0)
5421 #define ZEND_VM_SMART_BRANCH_TRUE() do { \
5422 if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5423 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5424 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5425 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5426 } else { \
5427 ZVAL_TRUE(EX_VAR(opline->result.var)); \
5428 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5429 } \
5430 ZEND_VM_CONTINUE(); \
5431 } while (0)
5432 #define ZEND_VM_SMART_BRANCH_TRUE_JMPZ() do { \
5433 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5434 ZEND_VM_CONTINUE(); \
5435 } while (0)
5436 #define ZEND_VM_SMART_BRANCH_TRUE_JMPNZ() do { \
5437 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5438 ZEND_VM_CONTINUE(); \
5439 } while (0)
5440 #define ZEND_VM_SMART_BRANCH_TRUE_NONE() do { \
5441 ZVAL_TRUE(EX_VAR(opline->result.var)); \
5442 ZEND_VM_NEXT_OPCODE(); \
5443 } while (0)
5444 #define ZEND_VM_SMART_BRANCH_FALSE() do { \
5445 if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5446 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5447 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5448 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5449 } else { \
5450 ZVAL_FALSE(EX_VAR(opline->result.var)); \
5451 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5452 } \
5453 ZEND_VM_CONTINUE(); \
5454 } while (0)
5455 #define ZEND_VM_SMART_BRANCH_FALSE_JMPZ() do { \
5456 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5457 ZEND_VM_CONTINUE(); \
5458 } while (0)
5459 #define ZEND_VM_SMART_BRANCH_FALSE_JMPNZ() do { \
5460 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5461 ZEND_VM_CONTINUE(); \
5462 } while (0)
5463 #define ZEND_VM_SMART_BRANCH_FALSE_NONE() do { \
5464 ZVAL_FALSE(EX_VAR(opline->result.var)); \
5465 ZEND_VM_NEXT_OPCODE(); \
5466 } while (0)
5467
5468 #ifdef __GNUC__
5469 # define ZEND_VM_GUARD(name) __asm__("#" #name)
5470 #else
5471 # define ZEND_VM_GUARD(name)
5472 #endif
5473
5474 #define UNDEF_RESULT() do { \
5475 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) { \
5476 ZVAL_UNDEF(EX_VAR(opline->result.var)); \
5477 } \
5478 } while (0)
5479
5480 /* This callback disables optimization of "vm_stack_data" variable in VM */
5481 ZEND_API void (ZEND_FASTCALL *zend_touch_vm_stack_data)(void *vm_stack_data) = NULL;
5482
5483 #include "zend_vm_execute.h"
5484
zend_set_user_opcode_handler(zend_uchar opcode,user_opcode_handler_t handler)5485 ZEND_API zend_result zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
5486 {
5487 if (opcode != ZEND_USER_OPCODE) {
5488 if (handler == NULL) {
5489 /* restore the original handler */
5490 zend_user_opcodes[opcode] = opcode;
5491 } else {
5492 zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
5493 }
5494 zend_user_opcode_handlers[opcode] = handler;
5495 return SUCCESS;
5496 }
5497 return FAILURE;
5498 }
5499
zend_get_user_opcode_handler(zend_uchar opcode)5500 ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
5501 {
5502 return zend_user_opcode_handlers[opcode];
5503 }
5504
zend_get_zval_ptr(const zend_op * opline,int op_type,const znode_op * node,const zend_execute_data * execute_data)5505 ZEND_API zval *zend_get_zval_ptr(const zend_op *opline, int op_type, const znode_op *node, const zend_execute_data *execute_data)
5506 {
5507 zval *ret;
5508
5509 switch (op_type) {
5510 case IS_CONST:
5511 ret = RT_CONSTANT(opline, *node);
5512 break;
5513 case IS_TMP_VAR:
5514 case IS_VAR:
5515 case IS_CV:
5516 ret = EX_VAR(node->var);
5517 break;
5518 default:
5519 ret = NULL;
5520 break;
5521 }
5522 return ret;
5523 }
5524