1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Nikita Popov <nikic@php.net>                                |
18    +----------------------------------------------------------------------+
19 */
20 
21 #include <zend_language_parser.h>
22 #include "zend.h"
23 #include "zend_compile.h"
24 #include "zend_constants.h"
25 #include "zend_llist.h"
26 #include "zend_API.h"
27 #include "zend_exceptions.h"
28 #include "zend_interfaces.h"
29 #include "zend_virtual_cwd.h"
30 #include "zend_multibyte.h"
31 #include "zend_language_scanner.h"
32 #include "zend_inheritance.h"
33 #include "zend_vm.h"
34 
35 #define SET_NODE(target, src) do { \
36 		target ## _type = (src)->op_type; \
37 		if ((src)->op_type == IS_CONST) { \
38 			target.constant = zend_add_literal(&(src)->u.constant); \
39 		} else { \
40 			target = (src)->u.op; \
41 		} \
42 	} while (0)
43 
44 #define GET_NODE(target, src) do { \
45 		(target)->op_type = src ## _type; \
46 		if ((target)->op_type == IS_CONST) { \
47 			ZVAL_COPY_VALUE(&(target)->u.constant, CT_CONSTANT(src)); \
48 		} else { \
49 			(target)->u.op = src; \
50 		} \
51 	} while (0)
52 
53 #define FC(member) (CG(file_context).member)
54 
55 typedef struct _zend_loop_var {
56 	zend_uchar opcode;
57 	zend_uchar var_type;
58 	uint32_t   var_num;
59 	uint32_t   try_catch_offset;
60 } zend_loop_var;
61 
zend_alloc_cache_slots(unsigned count)62 static inline uint32_t zend_alloc_cache_slots(unsigned count) {
63 	zend_op_array *op_array = CG(active_op_array);
64 	uint32_t ret = op_array->cache_size;
65 	op_array->cache_size += count * sizeof(void*);
66 	return ret;
67 }
68 
zend_alloc_cache_slot(void)69 static inline uint32_t zend_alloc_cache_slot(void) {
70 	return zend_alloc_cache_slots(1);
71 }
72 
73 ZEND_API zend_op_array *(*zend_compile_file)(zend_file_handle *file_handle, int type);
74 ZEND_API zend_op_array *(*zend_compile_string)(zval *source_string, char *filename);
75 
76 #ifndef ZTS
77 ZEND_API zend_compiler_globals compiler_globals;
78 ZEND_API zend_executor_globals executor_globals;
79 #endif
80 
81 static zend_op *zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2);
82 static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast);
83 
init_op(zend_op *op)84 static void init_op(zend_op *op)
85 {
86 	MAKE_NOP(op);
87 	op->extended_value = 0;
88 	op->lineno = CG(zend_lineno);
89 }
90 
get_next_op_number(void)91 static zend_always_inline uint32_t get_next_op_number(void)
92 {
93 	return CG(active_op_array)->last;
94 }
95 
get_next_op(void)96 static zend_op *get_next_op(void)
97 {
98 	zend_op_array *op_array = CG(active_op_array);
99 	uint32_t next_op_num = op_array->last++;
100 	zend_op *next_op;
101 
102 	if (UNEXPECTED(next_op_num >= CG(context).opcodes_size)) {
103 		CG(context).opcodes_size *= 4;
104 		op_array->opcodes = erealloc(op_array->opcodes, CG(context).opcodes_size * sizeof(zend_op));
105 	}
106 
107 	next_op = &(op_array->opcodes[next_op_num]);
108 
109 	init_op(next_op);
110 
111 	return next_op;
112 }
113 
get_next_brk_cont_element(void)114 static zend_brk_cont_element *get_next_brk_cont_element(void)
115 {
116 	CG(context).last_brk_cont++;
117 	CG(context).brk_cont_array = erealloc(CG(context).brk_cont_array, sizeof(zend_brk_cont_element) * CG(context).last_brk_cont);
118 	return &CG(context).brk_cont_array[CG(context).last_brk_cont-1];
119 }
120 
zend_destroy_property_info_internal(zval *zv)121 static void zend_destroy_property_info_internal(zval *zv) /* {{{ */
122 {
123 	zend_property_info *property_info = Z_PTR_P(zv);
124 
125 	zend_string_release(property_info->name);
126 	free(property_info);
127 }
128 /* }}} */
129 
zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno)130 static zend_string *zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno) /* {{{ */
131 {
132 	zend_string *filename = CG(active_op_array)->filename;
133 	zend_string *result = zend_strpprintf(0, "%c%s%s:%" PRIu32 "$%" PRIx32,
134 		'\0', ZSTR_VAL(name), ZSTR_VAL(filename), start_lineno, CG(rtd_key_counter)++);
135 	return zend_new_interned_string(result);
136 }
137 /* }}} */
138 
zend_get_unqualified_name(const zend_string *name, const char **result, size_t *result_len)139 static zend_bool zend_get_unqualified_name(const zend_string *name, const char **result, size_t *result_len) /* {{{ */
140 {
141 	const char *ns_separator = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
142 	if (ns_separator != NULL) {
143 		*result = ns_separator + 1;
144 		*result_len = ZSTR_VAL(name) + ZSTR_LEN(name) - *result;
145 		return 1;
146 	}
147 
148 	return 0;
149 }
150 /* }}} */
151 
152 struct reserved_class_name {
153 	const char *name;
154 	size_t len;
155 };
156 static const struct reserved_class_name reserved_class_names[] = {
157 	{ZEND_STRL("bool")},
158 	{ZEND_STRL("false")},
159 	{ZEND_STRL("float")},
160 	{ZEND_STRL("int")},
161 	{ZEND_STRL("null")},
162 	{ZEND_STRL("parent")},
163 	{ZEND_STRL("self")},
164 	{ZEND_STRL("static")},
165 	{ZEND_STRL("string")},
166 	{ZEND_STRL("true")},
167 	{ZEND_STRL("void")},
168 	{ZEND_STRL("iterable")},
169 	{ZEND_STRL("object")},
170 	{NULL, 0}
171 };
172 
zend_is_reserved_class_name(const zend_string *name)173 static zend_bool zend_is_reserved_class_name(const zend_string *name) /* {{{ */
174 {
175 	const struct reserved_class_name *reserved = reserved_class_names;
176 
177 	const char *uqname = ZSTR_VAL(name);
178 	size_t uqname_len = ZSTR_LEN(name);
179 	zend_get_unqualified_name(name, &uqname, &uqname_len);
180 
181 	for (; reserved->name; ++reserved) {
182 		if (uqname_len == reserved->len
183 			&& zend_binary_strcasecmp(uqname, uqname_len, reserved->name, reserved->len) == 0
184 		) {
185 			return 1;
186 		}
187 	}
188 
189 	return 0;
190 }
191 /* }}} */
192 
zend_assert_valid_class_name(const zend_string *name)193 void zend_assert_valid_class_name(const zend_string *name) /* {{{ */
194 {
195 	if (zend_is_reserved_class_name(name)) {
196 		zend_error_noreturn(E_COMPILE_ERROR,
197 			"Cannot use '%s' as class name as it is reserved", ZSTR_VAL(name));
198 	}
199 }
200 /* }}} */
201 
202 typedef struct _builtin_type_info {
203 	const char* name;
204 	const size_t name_len;
205 	const zend_uchar type;
206 } builtin_type_info;
207 
208 static const builtin_type_info builtin_types[] = {
209 	{ZEND_STRL("int"), IS_LONG},
210 	{ZEND_STRL("float"), IS_DOUBLE},
211 	{ZEND_STRL("string"), IS_STRING},
212 	{ZEND_STRL("bool"), _IS_BOOL},
213 	{ZEND_STRL("void"), IS_VOID},
214 	{ZEND_STRL("iterable"), IS_ITERABLE},
215 	{ZEND_STRL("object"), IS_OBJECT},
216 	{NULL, 0, IS_UNDEF}
217 };
218 
219 
zend_lookup_builtin_type_by_name(const zend_string *name)220 static zend_always_inline zend_uchar zend_lookup_builtin_type_by_name(const zend_string *name) /* {{{ */
221 {
222 	const builtin_type_info *info = &builtin_types[0];
223 
224 	for (; info->name; ++info) {
225 		if (ZSTR_LEN(name) == info->name_len
226 			&& zend_binary_strcasecmp(ZSTR_VAL(name), ZSTR_LEN(name), info->name, info->name_len) == 0
227 		) {
228 			return info->type;
229 		}
230 	}
231 
232 	return 0;
233 }
234 /* }}} */
235 
236 
zend_oparray_context_begin(zend_oparray_context *prev_context)237 void zend_oparray_context_begin(zend_oparray_context *prev_context) /* {{{ */
238 {
239 	*prev_context = CG(context);
240 	CG(context).opcodes_size = INITIAL_OP_ARRAY_SIZE;
241 	CG(context).vars_size = 0;
242 	CG(context).literals_size = 0;
243 	CG(context).fast_call_var = -1;
244 	CG(context).try_catch_offset = -1;
245 	CG(context).current_brk_cont = -1;
246 	CG(context).last_brk_cont = 0;
247 	CG(context).brk_cont_array = NULL;
248 	CG(context).labels = NULL;
249 }
250 /* }}} */
251 
zend_oparray_context_end(zend_oparray_context *prev_context)252 void zend_oparray_context_end(zend_oparray_context *prev_context) /* {{{ */
253 {
254 	if (CG(context).brk_cont_array) {
255 		efree(CG(context).brk_cont_array);
256 		CG(context).brk_cont_array = NULL;
257 	}
258 	if (CG(context).labels) {
259 		zend_hash_destroy(CG(context).labels);
260 		FREE_HASHTABLE(CG(context).labels);
261 		CG(context).labels = NULL;
262 	}
263 	CG(context) = *prev_context;
264 }
265 /* }}} */
266 
zend_reset_import_tables(void)267 static void zend_reset_import_tables(void) /* {{{ */
268 {
269 	if (FC(imports)) {
270 		zend_hash_destroy(FC(imports));
271 		efree(FC(imports));
272 		FC(imports) = NULL;
273 	}
274 
275 	if (FC(imports_function)) {
276 		zend_hash_destroy(FC(imports_function));
277 		efree(FC(imports_function));
278 		FC(imports_function) = NULL;
279 	}
280 
281 	if (FC(imports_const)) {
282 		zend_hash_destroy(FC(imports_const));
283 		efree(FC(imports_const));
284 		FC(imports_const) = NULL;
285 	}
286 }
287 /* }}} */
288 
zend_end_namespace(void)289 static void zend_end_namespace(void) /* {{{ */ {
290 	FC(in_namespace) = 0;
291 	zend_reset_import_tables();
292 	if (FC(current_namespace)) {
293 		zend_string_release_ex(FC(current_namespace), 0);
294 		FC(current_namespace) = NULL;
295 	}
296 }
297 /* }}} */
298 
zend_file_context_begin(zend_file_context *prev_context)299 void zend_file_context_begin(zend_file_context *prev_context) /* {{{ */
300 {
301 	*prev_context = CG(file_context);
302 	FC(imports) = NULL;
303 	FC(imports_function) = NULL;
304 	FC(imports_const) = NULL;
305 	FC(current_namespace) = NULL;
306 	FC(in_namespace) = 0;
307 	FC(has_bracketed_namespaces) = 0;
308 	FC(declarables).ticks = 0;
309 	zend_hash_init(&FC(seen_symbols), 8, NULL, NULL, 0);
310 }
311 /* }}} */
312 
zend_file_context_end(zend_file_context *prev_context)313 void zend_file_context_end(zend_file_context *prev_context) /* {{{ */
314 {
315 	zend_end_namespace();
316 	zend_hash_destroy(&FC(seen_symbols));
317 	CG(file_context) = *prev_context;
318 }
319 /* }}} */
320 
zend_init_compiler_data_structures(void)321 void zend_init_compiler_data_structures(void) /* {{{ */
322 {
323 	zend_stack_init(&CG(loop_var_stack), sizeof(zend_loop_var));
324 	zend_stack_init(&CG(delayed_oplines_stack), sizeof(zend_op));
325 	CG(active_class_entry) = NULL;
326 	CG(in_compilation) = 0;
327 	CG(skip_shebang) = 0;
328 
329 	CG(encoding_declared) = 0;
330 	CG(memoized_exprs) = NULL;
331 	CG(memoize_mode) = 0;
332 }
333 /* }}} */
334 
zend_register_seen_symbol(zend_string *name, uint32_t kind)335 static void zend_register_seen_symbol(zend_string *name, uint32_t kind) {
336 	zval *zv = zend_hash_find(&FC(seen_symbols), name);
337 	if (zv) {
338 		Z_LVAL_P(zv) |= kind;
339 	} else {
340 		zval tmp;
341 		ZVAL_LONG(&tmp, kind);
342 		zend_hash_add_new(&FC(seen_symbols), name, &tmp);
343 	}
344 }
345 
zend_have_seen_symbol(zend_string *name, uint32_t kind)346 static zend_bool zend_have_seen_symbol(zend_string *name, uint32_t kind) {
347 	zval *zv = zend_hash_find(&FC(seen_symbols), name);
348 	return zv && (Z_LVAL_P(zv) & kind) != 0;
349 }
350 
file_handle_dtor(zend_file_handle *fh)351 ZEND_API void file_handle_dtor(zend_file_handle *fh) /* {{{ */
352 {
353 
354 	zend_file_handle_dtor(fh);
355 }
356 /* }}} */
357 
init_compiler(void)358 void init_compiler(void) /* {{{ */
359 {
360 	CG(arena) = zend_arena_create(64 * 1024);
361 	CG(active_op_array) = NULL;
362 	memset(&CG(context), 0, sizeof(CG(context)));
363 	zend_init_compiler_data_structures();
364 	zend_init_rsrc_list();
365 	zend_hash_init(&CG(filenames_table), 8, NULL, ZVAL_PTR_DTOR, 0);
366 	zend_llist_init(&CG(open_files), sizeof(zend_file_handle), (void (*)(void *)) file_handle_dtor, 0);
367 	CG(unclean_shutdown) = 0;
368 
369 	CG(delayed_variance_obligations) = NULL;
370 	CG(delayed_autoloads) = NULL;
371 }
372 /* }}} */
373 
shutdown_compiler(void)374 void shutdown_compiler(void) /* {{{ */
375 {
376 	zend_stack_destroy(&CG(loop_var_stack));
377 	zend_stack_destroy(&CG(delayed_oplines_stack));
378 	zend_hash_destroy(&CG(filenames_table));
379 	zend_arena_destroy(CG(arena));
380 
381 	if (CG(delayed_variance_obligations)) {
382 		zend_hash_destroy(CG(delayed_variance_obligations));
383 		FREE_HASHTABLE(CG(delayed_variance_obligations));
384 		CG(delayed_variance_obligations) = NULL;
385 	}
386 	if (CG(delayed_autoloads)) {
387 		zend_hash_destroy(CG(delayed_autoloads));
388 		FREE_HASHTABLE(CG(delayed_autoloads));
389 		CG(delayed_autoloads) = NULL;
390 	}
391 }
392 /* }}} */
393 
zend_set_compiled_filename(zend_string *new_compiled_filename)394 ZEND_API zend_string *zend_set_compiled_filename(zend_string *new_compiled_filename) /* {{{ */
395 {
396 	zval *p, rv;
397 
398 	if ((p = zend_hash_find(&CG(filenames_table), new_compiled_filename))) {
399 		ZEND_ASSERT(Z_TYPE_P(p) == IS_STRING);
400 		CG(compiled_filename) = Z_STR_P(p);
401 		return Z_STR_P(p);
402 	}
403 
404 	new_compiled_filename = zend_new_interned_string(zend_string_copy(new_compiled_filename));
405 	ZVAL_STR(&rv, new_compiled_filename);
406 	zend_hash_add_new(&CG(filenames_table), new_compiled_filename, &rv);
407 
408 	CG(compiled_filename) = new_compiled_filename;
409 	return new_compiled_filename;
410 }
411 /* }}} */
412 
zend_restore_compiled_filename(zend_string *original_compiled_filename)413 ZEND_API void zend_restore_compiled_filename(zend_string *original_compiled_filename) /* {{{ */
414 {
415 	CG(compiled_filename) = original_compiled_filename;
416 }
417 /* }}} */
418 
zend_get_compiled_filename(void)419 ZEND_API zend_string *zend_get_compiled_filename(void) /* {{{ */
420 {
421 	return CG(compiled_filename);
422 }
423 /* }}} */
424 
zend_get_compiled_lineno(void)425 ZEND_API int zend_get_compiled_lineno(void) /* {{{ */
426 {
427 	return CG(zend_lineno);
428 }
429 /* }}} */
430 
zend_is_compiling(void)431 ZEND_API zend_bool zend_is_compiling(void) /* {{{ */
432 {
433 	return CG(in_compilation);
434 }
435 /* }}} */
436 
get_temporary_variable(void)437 static zend_always_inline uint32_t get_temporary_variable(void) /* {{{ */
438 {
439 	return (uint32_t)CG(active_op_array)->T++;
440 }
441 /* }}} */
442 
lookup_cv(zend_string *name)443 static int lookup_cv(zend_string *name) /* {{{ */{
444 	zend_op_array *op_array = CG(active_op_array);
445 	int i = 0;
446 	zend_ulong hash_value = zend_string_hash_val(name);
447 
448 	while (i < op_array->last_var) {
449 		if (ZSTR_H(op_array->vars[i]) == hash_value
450 		 && zend_string_equals(op_array->vars[i], name)) {
451 			return (int)(zend_intptr_t)ZEND_CALL_VAR_NUM(NULL, i);
452 		}
453 		i++;
454 	}
455 	i = op_array->last_var;
456 	op_array->last_var++;
457 	if (op_array->last_var > CG(context).vars_size) {
458 		CG(context).vars_size += 16; /* FIXME */
459 		op_array->vars = erealloc(op_array->vars, CG(context).vars_size * sizeof(zend_string*));
460 	}
461 
462 	op_array->vars[i] = zend_string_copy(name);
463 	return (int)(zend_intptr_t)ZEND_CALL_VAR_NUM(NULL, i);
464 }
465 /* }}} */
466 
zend_del_literal(zend_op_array *op_array, int n)467 void zend_del_literal(zend_op_array *op_array, int n) /* {{{ */
468 {
469 	zval_ptr_dtor_nogc(CT_CONSTANT_EX(op_array, n));
470 	if (n + 1 == op_array->last_literal) {
471 		op_array->last_literal--;
472 	} else {
473 		ZVAL_UNDEF(CT_CONSTANT_EX(op_array, n));
474 	}
475 }
476 /* }}} */
477 
zval_make_interned_string(zval *zv)478 static inline zend_string *zval_make_interned_string(zval *zv) /* {{{ */
479 {
480 	ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);
481 	Z_STR_P(zv) = zend_new_interned_string(Z_STR_P(zv));
482 	if (ZSTR_IS_INTERNED(Z_STR_P(zv))) {
483 		Z_TYPE_FLAGS_P(zv) = 0;
484 	}
485 	return Z_STR_P(zv);
486 }
487 
488 /* Common part of zend_add_literal and zend_append_individual_literal */
zend_insert_literal(zend_op_array *op_array, zval *zv, int literal_position)489 static inline void zend_insert_literal(zend_op_array *op_array, zval *zv, int literal_position) /* {{{ */
490 {
491 	zval *lit = CT_CONSTANT_EX(op_array, literal_position);
492 	if (Z_TYPE_P(zv) == IS_STRING) {
493 		zval_make_interned_string(zv);
494 	}
495 	ZVAL_COPY_VALUE(lit, zv);
496 	Z_EXTRA_P(lit) = 0;
497 }
498 /* }}} */
499 
500 /* Is used while compiling a function, using the context to keep track
501    of an approximate size to avoid to relocate to often.
502    Literals are truncated to actual size in the second compiler pass (pass_two()). */
zend_add_literal(zval *zv)503 static int zend_add_literal(zval *zv) /* {{{ */
504 {
505 	zend_op_array *op_array = CG(active_op_array);
506 	int i = op_array->last_literal;
507 	op_array->last_literal++;
508 	if (i >= CG(context).literals_size) {
509 		while (i >= CG(context).literals_size) {
510 			CG(context).literals_size += 16; /* FIXME */
511 		}
512 		op_array->literals = (zval*)erealloc(op_array->literals, CG(context).literals_size * sizeof(zval));
513 	}
514 	zend_insert_literal(op_array, zv, i);
515 	return i;
516 }
517 /* }}} */
518 
zend_add_literal_string(zend_string **str)519 static inline int zend_add_literal_string(zend_string **str) /* {{{ */
520 {
521 	int ret;
522 	zval zv;
523 	ZVAL_STR(&zv, *str);
524 	ret = zend_add_literal(&zv);
525 	*str = Z_STR(zv);
526 	return ret;
527 }
528 /* }}} */
529 
zend_add_func_name_literal(zend_string *name)530 static int zend_add_func_name_literal(zend_string *name) /* {{{ */
531 {
532 	/* Original name */
533 	int ret = zend_add_literal_string(&name);
534 
535 	/* Lowercased name */
536 	zend_string *lc_name = zend_string_tolower(name);
537 	zend_add_literal_string(&lc_name);
538 
539 	return ret;
540 }
541 /* }}} */
542 
zend_add_ns_func_name_literal(zend_string *name)543 static int zend_add_ns_func_name_literal(zend_string *name) /* {{{ */
544 {
545 	const char *unqualified_name;
546 	size_t unqualified_name_len;
547 
548 	/* Original name */
549 	int ret = zend_add_literal_string(&name);
550 
551 	/* Lowercased name */
552 	zend_string *lc_name = zend_string_tolower(name);
553 	zend_add_literal_string(&lc_name);
554 
555 	/* Lowercased unqualfied name */
556 	if (zend_get_unqualified_name(name, &unqualified_name, &unqualified_name_len)) {
557 		lc_name = zend_string_alloc(unqualified_name_len, 0);
558 		zend_str_tolower_copy(ZSTR_VAL(lc_name), unqualified_name, unqualified_name_len);
559 		zend_add_literal_string(&lc_name);
560 	}
561 
562 	return ret;
563 }
564 /* }}} */
565 
zend_add_class_name_literal(zend_string *name)566 static int zend_add_class_name_literal(zend_string *name) /* {{{ */
567 {
568 	/* Original name */
569 	int ret = zend_add_literal_string(&name);
570 
571 	/* Lowercased name */
572 	zend_string *lc_name = zend_string_tolower(name);
573 	zend_add_literal_string(&lc_name);
574 
575 	return ret;
576 }
577 /* }}} */
578 
zend_add_const_name_literal(zend_string *name, zend_bool unqualified)579 static int zend_add_const_name_literal(zend_string *name, zend_bool unqualified) /* {{{ */
580 {
581 	zend_string *tmp_name;
582 
583 	int ret = zend_add_literal_string(&name);
584 
585 	size_t ns_len = 0, after_ns_len = ZSTR_LEN(name);
586 	const char *after_ns = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
587 	if (after_ns) {
588 		after_ns += 1;
589 		ns_len = after_ns - ZSTR_VAL(name) - 1;
590 		after_ns_len = ZSTR_LEN(name) - ns_len - 1;
591 
592 		/* lowercased namespace name & original constant name */
593 		tmp_name = zend_string_init(ZSTR_VAL(name), ZSTR_LEN(name), 0);
594 		zend_str_tolower(ZSTR_VAL(tmp_name), ns_len);
595 		zend_add_literal_string(&tmp_name);
596 
597 		/* lowercased namespace name & lowercased constant name */
598 		tmp_name = zend_string_tolower(name);
599 		zend_add_literal_string(&tmp_name);
600 
601 		if (!unqualified) {
602 			return ret;
603 		}
604 	} else {
605 		after_ns = ZSTR_VAL(name);
606 	}
607 
608 	/* original unqualified constant name */
609 	tmp_name = zend_string_init(after_ns, after_ns_len, 0);
610 	zend_add_literal_string(&tmp_name);
611 
612 	/* lowercased unqualified constant name */
613 	tmp_name = zend_string_alloc(after_ns_len, 0);
614 	zend_str_tolower_copy(ZSTR_VAL(tmp_name), after_ns, after_ns_len);
615 	zend_add_literal_string(&tmp_name);
616 
617 	return ret;
618 }
619 /* }}} */
620 
621 #define LITERAL_STR(op, str) do { \
622 		zval _c; \
623 		ZVAL_STR(&_c, str); \
624 		op.constant = zend_add_literal(&_c); \
625 	} while (0)
626 
zend_stop_lexing(void)627 void zend_stop_lexing(void)
628 {
629 	if (LANG_SCNG(on_event)) {
630 		LANG_SCNG(on_event)(ON_STOP, END, 0, LANG_SCNG(on_event_context));
631 	}
632 
633 	LANG_SCNG(yy_cursor) = LANG_SCNG(yy_limit);
634 }
635 
zend_begin_loop( zend_uchar free_opcode, const znode *loop_var, zend_bool is_switch)636 static inline void zend_begin_loop(
637 		zend_uchar free_opcode, const znode *loop_var, zend_bool is_switch) /* {{{ */
638 {
639 	zend_brk_cont_element *brk_cont_element;
640 	int parent = CG(context).current_brk_cont;
641 	zend_loop_var info = {0};
642 
643 	CG(context).current_brk_cont = CG(context).last_brk_cont;
644 	brk_cont_element = get_next_brk_cont_element();
645 	brk_cont_element->parent = parent;
646 	brk_cont_element->is_switch = is_switch;
647 
648 	if (loop_var && (loop_var->op_type & (IS_VAR|IS_TMP_VAR))) {
649 		uint32_t start = get_next_op_number();
650 
651 		info.opcode = free_opcode;
652 		info.var_type = loop_var->op_type;
653 		info.var_num = loop_var->u.op.var;
654 		brk_cont_element->start = start;
655 	} else {
656 		info.opcode = ZEND_NOP;
657 		/* The start field is used to free temporary variables in case of exceptions.
658 		 * We won't try to free something of we don't have loop variable.  */
659 		brk_cont_element->start = -1;
660 	}
661 
662 	zend_stack_push(&CG(loop_var_stack), &info);
663 }
664 /* }}} */
665 
zend_end_loop(int cont_addr, const znode *var_node)666 static inline void zend_end_loop(int cont_addr, const znode *var_node) /* {{{ */
667 {
668 	uint32_t end = get_next_op_number();
669 	zend_brk_cont_element *brk_cont_element
670 		= &CG(context).brk_cont_array[CG(context).current_brk_cont];
671 	brk_cont_element->cont = cont_addr;
672 	brk_cont_element->brk = end;
673 	CG(context).current_brk_cont = brk_cont_element->parent;
674 
675 	zend_stack_del_top(&CG(loop_var_stack));
676 }
677 /* }}} */
678 
zend_do_free(znode *op1)679 void zend_do_free(znode *op1) /* {{{ */
680 {
681 	if (op1->op_type == IS_TMP_VAR) {
682 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
683 
684 		while (opline->opcode == ZEND_END_SILENCE) {
685 			opline--;
686 		}
687 
688 		if (opline->result_type == IS_TMP_VAR && opline->result.var == op1->u.op.var) {
689 			if (opline->opcode == ZEND_BOOL || opline->opcode == ZEND_BOOL_NOT) {
690 				return;
691 			}
692 		}
693 
694 		zend_emit_op(NULL, ZEND_FREE, op1, NULL);
695 	} else if (op1->op_type == IS_VAR) {
696 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
697 		while (opline->opcode == ZEND_END_SILENCE ||
698 				opline->opcode == ZEND_EXT_FCALL_END ||
699 				opline->opcode == ZEND_OP_DATA) {
700 			opline--;
701 		}
702 		if (opline->result_type == IS_VAR
703 			&& opline->result.var == op1->u.op.var) {
704 			if (opline->opcode == ZEND_FETCH_THIS) {
705 				opline->opcode = ZEND_NOP;
706 				opline->result_type = IS_UNUSED;
707 			} else {
708 				opline->result_type = IS_UNUSED;
709 			}
710 		} else {
711 			while (opline >= CG(active_op_array)->opcodes) {
712 				if ((opline->opcode == ZEND_FETCH_LIST_R ||
713                      opline->opcode == ZEND_FETCH_LIST_W) &&
714 				    opline->op1_type == IS_VAR &&
715 				    opline->op1.var == op1->u.op.var) {
716 					zend_emit_op(NULL, ZEND_FREE, op1, NULL);
717 					return;
718 				}
719 				if (opline->result_type == IS_VAR
720 					&& opline->result.var == op1->u.op.var) {
721 					if (opline->opcode == ZEND_NEW) {
722 						zend_emit_op(NULL, ZEND_FREE, op1, NULL);
723 					}
724 					break;
725 				}
726 				opline--;
727 			}
728 		}
729 	} else if (op1->op_type == IS_CONST) {
730 		/* Destroy value without using GC: When opcache moves arrays into SHM it will
731 		 * free the zend_array structure, so references to it from outside the op array
732 		 * become invalid. GC would cause such a reference in the root buffer. */
733 		zval_ptr_dtor_nogc(&op1->u.constant);
734 	}
735 }
736 /* }}} */
737 
zend_add_class_modifier(uint32_t flags, uint32_t new_flag)738 uint32_t zend_add_class_modifier(uint32_t flags, uint32_t new_flag) /* {{{ */
739 {
740 	uint32_t new_flags = flags | new_flag;
741 	if ((flags & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS) && (new_flag & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS)) {
742 		zend_throw_exception(zend_ce_compile_error,
743 			"Multiple abstract modifiers are not allowed", 0);
744 		return 0;
745 	}
746 	if ((flags & ZEND_ACC_FINAL) && (new_flag & ZEND_ACC_FINAL)) {
747 		zend_throw_exception(zend_ce_compile_error, "Multiple final modifiers are not allowed", 0);
748 		return 0;
749 	}
750 	if ((new_flags & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS) && (new_flags & ZEND_ACC_FINAL)) {
751 		zend_throw_exception(zend_ce_compile_error,
752 			"Cannot use the final modifier on an abstract class", 0);
753 		return 0;
754 	}
755 	return new_flags;
756 }
757 /* }}} */
758 
zend_add_member_modifier(uint32_t flags, uint32_t new_flag)759 uint32_t zend_add_member_modifier(uint32_t flags, uint32_t new_flag) /* {{{ */
760 {
761 	uint32_t new_flags = flags | new_flag;
762 	if ((flags & ZEND_ACC_PPP_MASK) && (new_flag & ZEND_ACC_PPP_MASK)) {
763 		zend_throw_exception(zend_ce_compile_error,
764 			"Multiple access type modifiers are not allowed", 0);
765 		return 0;
766 	}
767 	if ((flags & ZEND_ACC_ABSTRACT) && (new_flag & ZEND_ACC_ABSTRACT)) {
768 		zend_throw_exception(zend_ce_compile_error, "Multiple abstract modifiers are not allowed", 0);
769 		return 0;
770 	}
771 	if ((flags & ZEND_ACC_STATIC) && (new_flag & ZEND_ACC_STATIC)) {
772 		zend_throw_exception(zend_ce_compile_error, "Multiple static modifiers are not allowed", 0);
773 		return 0;
774 	}
775 	if ((flags & ZEND_ACC_FINAL) && (new_flag & ZEND_ACC_FINAL)) {
776 		zend_throw_exception(zend_ce_compile_error, "Multiple final modifiers are not allowed", 0);
777 		return 0;
778 	}
779 	if ((new_flags & ZEND_ACC_ABSTRACT) && (new_flags & ZEND_ACC_FINAL)) {
780 		zend_throw_exception(zend_ce_compile_error,
781 			"Cannot use the final modifier on an abstract class member", 0);
782 		return 0;
783 	}
784 	return new_flags;
785 }
786 /* }}} */
787 
zend_concat3(char *str1, size_t str1_len, char *str2, size_t str2_len, char *str3, size_t str3_len)788 zend_string *zend_concat3(char *str1, size_t str1_len, char *str2, size_t str2_len, char *str3, size_t str3_len) /* {{{ */
789 {
790 	size_t len = str1_len + str2_len + str3_len;
791 	zend_string *res = zend_string_alloc(len, 0);
792 
793 	memcpy(ZSTR_VAL(res), str1, str1_len);
794 	memcpy(ZSTR_VAL(res) + str1_len, str2, str2_len);
795 	memcpy(ZSTR_VAL(res) + str1_len + str2_len, str3, str3_len);
796 	ZSTR_VAL(res)[len] = '\0';
797 
798 	return res;
799 }
800 
zend_concat_names(char *name1, size_t name1_len, char *name2, size_t name2_len)801 zend_string *zend_concat_names(char *name1, size_t name1_len, char *name2, size_t name2_len) {
802 	return zend_concat3(name1, name1_len, "\\", 1, name2, name2_len);
803 }
804 
zend_prefix_with_ns(zend_string *name)805 zend_string *zend_prefix_with_ns(zend_string *name) {
806 	if (FC(current_namespace)) {
807 		zend_string *ns = FC(current_namespace);
808 		return zend_concat_names(ZSTR_VAL(ns), ZSTR_LEN(ns), ZSTR_VAL(name), ZSTR_LEN(name));
809 	} else {
810 		return zend_string_copy(name);
811 	}
812 }
813 
zend_hash_find_ptr_lc(HashTable *ht, const char *str, size_t len)814 void *zend_hash_find_ptr_lc(HashTable *ht, const char *str, size_t len) {
815 	void *result;
816 	zend_string *lcname;
817 	ALLOCA_FLAG(use_heap);
818 
819 	ZSTR_ALLOCA_ALLOC(lcname, len, use_heap);
820 	zend_str_tolower_copy(ZSTR_VAL(lcname), str, len);
821 	result = zend_hash_find_ptr(ht, lcname);
822 	ZSTR_ALLOCA_FREE(lcname, use_heap);
823 
824 	return result;
825 }
826 
zend_resolve_non_class_name( zend_string *name, uint32_t type, zend_bool *is_fully_qualified, zend_bool case_sensitive, HashTable *current_import_sub )827 zend_string *zend_resolve_non_class_name(
828 	zend_string *name, uint32_t type, zend_bool *is_fully_qualified,
829 	zend_bool case_sensitive, HashTable *current_import_sub
830 ) {
831 	char *compound;
832 	*is_fully_qualified = 0;
833 
834 	if (ZSTR_VAL(name)[0] == '\\') {
835 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
836 		*is_fully_qualified = 1;
837 		return zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
838 	}
839 
840 	if (type == ZEND_NAME_FQ) {
841 		*is_fully_qualified = 1;
842 		return zend_string_copy(name);
843 	}
844 
845 	if (type == ZEND_NAME_RELATIVE) {
846 		*is_fully_qualified = 1;
847 		return zend_prefix_with_ns(name);
848 	}
849 
850 	if (current_import_sub) {
851 		/* If an unqualified name is a function/const alias, replace it. */
852 		zend_string *import_name;
853 		if (case_sensitive) {
854 			import_name = zend_hash_find_ptr(current_import_sub, name);
855 		} else {
856 			import_name = zend_hash_find_ptr_lc(current_import_sub, ZSTR_VAL(name), ZSTR_LEN(name));
857 		}
858 
859 		if (import_name) {
860 			*is_fully_qualified = 1;
861 			return zend_string_copy(import_name);
862 		}
863 	}
864 
865 	compound = memchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
866 	if (compound) {
867 		*is_fully_qualified = 1;
868 	}
869 
870 	if (compound && FC(imports)) {
871 		/* If the first part of a qualified name is an alias, substitute it. */
872 		size_t len = compound - ZSTR_VAL(name);
873 		zend_string *import_name = zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), len);
874 
875 		if (import_name) {
876 			return zend_concat_names(
877 				ZSTR_VAL(import_name), ZSTR_LEN(import_name), ZSTR_VAL(name) + len + 1, ZSTR_LEN(name) - len - 1);
878 		}
879 	}
880 
881 	return zend_prefix_with_ns(name);
882 }
883 /* }}} */
884 
zend_resolve_function_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified)885 zend_string *zend_resolve_function_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified) /* {{{ */
886 {
887 	return zend_resolve_non_class_name(
888 		name, type, is_fully_qualified, 0, FC(imports_function));
889 }
890 /* }}} */
891 
zend_resolve_const_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified)892 zend_string *zend_resolve_const_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified) /* {{{ */ {
893 	return zend_resolve_non_class_name(
894 		name, type, is_fully_qualified, 1, FC(imports_const));
895 }
896 /* }}} */
897 
zend_resolve_class_name(zend_string *name, uint32_t type)898 zend_string *zend_resolve_class_name(zend_string *name, uint32_t type) /* {{{ */
899 {
900 	char *compound;
901 
902 	if (type == ZEND_NAME_RELATIVE) {
903 		return zend_prefix_with_ns(name);
904 	}
905 
906 	if (type == ZEND_NAME_FQ || ZSTR_VAL(name)[0] == '\\') {
907 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
908 		if (ZSTR_VAL(name)[0] == '\\') {
909 			name = zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
910 		} else {
911 			zend_string_addref(name);
912 		}
913 		/* Ensure that \self, \parent and \static are not used */
914 		if (ZEND_FETCH_CLASS_DEFAULT != zend_get_class_fetch_type(name)) {
915 			zend_error_noreturn(E_COMPILE_ERROR, "'\\%s' is an invalid class name", ZSTR_VAL(name));
916 		}
917 		return name;
918 	}
919 
920 	if (FC(imports)) {
921 		compound = memchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
922 		if (compound) {
923 			/* If the first part of a qualified name is an alias, substitute it. */
924 			size_t len = compound - ZSTR_VAL(name);
925 			zend_string *import_name =
926 				zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), len);
927 
928 			if (import_name) {
929 				return zend_concat_names(
930 					ZSTR_VAL(import_name), ZSTR_LEN(import_name), ZSTR_VAL(name) + len + 1, ZSTR_LEN(name) - len - 1);
931 			}
932 		} else {
933 			/* If an unqualified name is an alias, replace it. */
934 			zend_string *import_name
935 				= zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), ZSTR_LEN(name));
936 
937 			if (import_name) {
938 				return zend_string_copy(import_name);
939 			}
940 		}
941 	}
942 
943 	/* If not fully qualified and not an alias, prepend the current namespace */
944 	return zend_prefix_with_ns(name);
945 }
946 /* }}} */
947 
zend_resolve_class_name_ast(zend_ast *ast)948 zend_string *zend_resolve_class_name_ast(zend_ast *ast) /* {{{ */
949 {
950 	zval *class_name = zend_ast_get_zval(ast);
951 	if (Z_TYPE_P(class_name) != IS_STRING) {
952 		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
953 	}
954 	return zend_resolve_class_name(Z_STR_P(class_name), ast->attr);
955 }
956 /* }}} */
957 
label_ptr_dtor(zval *zv)958 static void label_ptr_dtor(zval *zv) /* {{{ */
959 {
960 	efree_size(Z_PTR_P(zv), sizeof(zend_label));
961 }
962 /* }}} */
963 
str_dtor(zval *zv)964 static void str_dtor(zval *zv)  /* {{{ */ {
965 	zend_string_release_ex(Z_STR_P(zv), 0);
966 }
967 /* }}} */
968 
969 static zend_bool zend_is_call(zend_ast *ast);
970 
zend_add_try_element(uint32_t try_op)971 static uint32_t zend_add_try_element(uint32_t try_op) /* {{{ */
972 {
973 	zend_op_array *op_array = CG(active_op_array);
974 	uint32_t try_catch_offset = op_array->last_try_catch++;
975 	zend_try_catch_element *elem;
976 
977 	op_array->try_catch_array = safe_erealloc(
978 		op_array->try_catch_array, sizeof(zend_try_catch_element), op_array->last_try_catch, 0);
979 
980 	elem = &op_array->try_catch_array[try_catch_offset];
981 	elem->try_op = try_op;
982 	elem->catch_op = 0;
983 	elem->finally_op = 0;
984 	elem->finally_end = 0;
985 
986 	return try_catch_offset;
987 }
988 /* }}} */
989 
function_add_ref(zend_function *function)990 ZEND_API void function_add_ref(zend_function *function) /* {{{ */
991 {
992 	if (function->type == ZEND_USER_FUNCTION) {
993 		zend_op_array *op_array = &function->op_array;
994 
995 		if (op_array->refcount) {
996 			(*op_array->refcount)++;
997 		}
998 		if (op_array->static_variables) {
999 			if (!(GC_FLAGS(op_array->static_variables) & IS_ARRAY_IMMUTABLE)) {
1000 				GC_ADDREF(op_array->static_variables);
1001 			}
1002 		}
1003 
1004 		if (CG(compiler_options) & ZEND_COMPILE_PRELOAD) {
1005 			ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_PRELOADED);
1006 			ZEND_MAP_PTR_NEW(op_array->run_time_cache);
1007 			ZEND_MAP_PTR_NEW(op_array->static_variables_ptr);
1008 		} else {
1009 			ZEND_MAP_PTR_INIT(op_array->static_variables_ptr, &op_array->static_variables);
1010 			ZEND_MAP_PTR_INIT(op_array->run_time_cache, zend_arena_alloc(&CG(arena), sizeof(void*)));
1011 			ZEND_MAP_PTR_SET(op_array->run_time_cache, NULL);
1012 		}
1013 	} else if (function->type == ZEND_INTERNAL_FUNCTION) {
1014 		if (function->common.function_name) {
1015 			zend_string_addref(function->common.function_name);
1016 		}
1017 	}
1018 }
1019 /* }}} */
1020 
do_bind_function_error(zend_string *lcname, zend_op_array *op_array, zend_bool compile_time)1021 static zend_never_inline ZEND_COLD ZEND_NORETURN void do_bind_function_error(zend_string *lcname, zend_op_array *op_array, zend_bool compile_time) /* {{{ */
1022 {
1023 	zval *zv = zend_hash_find_ex(compile_time ? CG(function_table) : EG(function_table), lcname, 1);
1024 	int error_level = compile_time ? E_COMPILE_ERROR : E_ERROR;
1025 	zend_function *old_function;
1026 
1027 	ZEND_ASSERT(zv != NULL);
1028 	old_function = (zend_function*)Z_PTR_P(zv);
1029 	if (old_function->type == ZEND_USER_FUNCTION
1030 		&& old_function->op_array.last > 0) {
1031 		zend_error_noreturn(error_level, "Cannot redeclare %s() (previously declared in %s:%d)",
1032 					op_array ? ZSTR_VAL(op_array->function_name) : ZSTR_VAL(old_function->common.function_name),
1033 					ZSTR_VAL(old_function->op_array.filename),
1034 					old_function->op_array.opcodes[0].lineno);
1035 	} else {
1036 		zend_error_noreturn(error_level, "Cannot redeclare %s()",
1037 			op_array ? ZSTR_VAL(op_array->function_name) : ZSTR_VAL(old_function->common.function_name));
1038 	}
1039 }
1040 
do_bind_function(zval *lcname)1041 ZEND_API int do_bind_function(zval *lcname) /* {{{ */
1042 {
1043 	zend_function *function;
1044 	zval *rtd_key, *zv;
1045 
1046 	rtd_key = lcname + 1;
1047 	zv = zend_hash_find_ex(EG(function_table), Z_STR_P(rtd_key), 1);
1048 	if (UNEXPECTED(!zv)) {
1049 		do_bind_function_error(Z_STR_P(lcname), NULL, 0);
1050 		return FAILURE;
1051 	}
1052 	function = (zend_function*)Z_PTR_P(zv);
1053 	if (UNEXPECTED(function->common.fn_flags & ZEND_ACC_PRELOADED)
1054 			&& !(CG(compiler_options) & ZEND_COMPILE_PRELOAD)) {
1055 		zv = zend_hash_add(EG(function_table), Z_STR_P(lcname), zv);
1056 	} else {
1057 		zv = zend_hash_set_bucket_key(EG(function_table), (Bucket*)zv, Z_STR_P(lcname));
1058 	}
1059 	if (UNEXPECTED(!zv)) {
1060 		do_bind_function_error(Z_STR_P(lcname), &function->op_array, 0);
1061 		return FAILURE;
1062 	}
1063 	return SUCCESS;
1064 }
1065 /* }}} */
1066 
do_bind_class(zval *lcname, zend_string *lc_parent_name)1067 ZEND_API int do_bind_class(zval *lcname, zend_string *lc_parent_name) /* {{{ */
1068 {
1069 	zend_class_entry *ce;
1070 	zval *rtd_key, *zv;
1071 
1072 	rtd_key = lcname + 1;
1073 
1074 	zv = zend_hash_find_ex(EG(class_table), Z_STR_P(rtd_key), 1);
1075 
1076 	if (UNEXPECTED(!zv)) {
1077 		ce = zend_hash_find_ptr(EG(class_table), Z_STR_P(lcname));
1078 		if (ce) {
1079 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
1080 			return FAILURE;
1081 		} else {
1082 			do {
1083 				ZEND_ASSERT(EG(current_execute_data)->func->op_array.fn_flags & ZEND_ACC_PRELOADED);
1084 				if (zend_preload_autoload
1085 				  && zend_preload_autoload(EG(current_execute_data)->func->op_array.filename) == SUCCESS) {
1086 					zv = zend_hash_find_ex(EG(class_table), Z_STR_P(rtd_key), 1);
1087 					if (EXPECTED(zv != NULL)) {
1088 						break;
1089 					}
1090 				}
1091 				zend_error_noreturn(E_ERROR, "Class %s wasn't preloaded", Z_STRVAL_P(lcname));
1092 				return FAILURE;
1093 			} while (0);
1094 		}
1095 	}
1096 
1097 	/* Register the derived class */
1098 	ce = (zend_class_entry*)Z_PTR_P(zv);
1099 	zv = zend_hash_set_bucket_key(EG(class_table), (Bucket*)zv, Z_STR_P(lcname));
1100 	if (UNEXPECTED(!zv)) {
1101 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
1102 		return FAILURE;
1103 	}
1104 
1105 	if (zend_do_link_class(ce, lc_parent_name) == FAILURE) {
1106 		/* Reload bucket pointer, the hash table may have been reallocated */
1107 		zv = zend_hash_find(EG(class_table), Z_STR_P(lcname));
1108 		zend_hash_set_bucket_key(EG(class_table), (Bucket *) zv, Z_STR_P(rtd_key));
1109 		return FAILURE;
1110 	}
1111 
1112 	return SUCCESS;
1113 }
1114 /* }}} */
1115 
zend_mark_function_as_generatornull1116 static void zend_mark_function_as_generator() /* {{{ */
1117 {
1118 	if (!CG(active_op_array)->function_name) {
1119 		zend_error_noreturn(E_COMPILE_ERROR,
1120 			"The \"yield\" expression can only be used inside a function");
1121 	}
1122 
1123 	if (CG(active_op_array)->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
1124 		zend_arg_info return_info = CG(active_op_array)->arg_info[-1];
1125 
1126 		if (ZEND_TYPE_CODE(return_info.type) != IS_ITERABLE) {
1127 			const char *msg = "Generators may only declare a return type of Generator, Iterator, Traversable, or iterable, %s is not permitted";
1128 
1129 			if (!ZEND_TYPE_IS_CLASS(return_info.type)) {
1130 				zend_error_noreturn(E_COMPILE_ERROR, msg, zend_get_type_by_const(ZEND_TYPE_CODE(return_info.type)));
1131 			}
1132 
1133 			if (!zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Traversable")
1134 				&& !zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Iterator")
1135 				&& !zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Generator")) {
1136 				zend_error_noreturn(E_COMPILE_ERROR, msg, ZSTR_VAL(ZEND_TYPE_NAME(return_info.type)));
1137 			}
1138 		}
1139 	}
1140 
1141 	CG(active_op_array)->fn_flags |= ZEND_ACC_GENERATOR;
1142 }
1143 /* }}} */
1144 
zend_build_delayed_early_binding_list(const zend_op_array *op_array)1145 ZEND_API uint32_t zend_build_delayed_early_binding_list(const zend_op_array *op_array) /* {{{ */
1146 {
1147 	if (op_array->fn_flags & ZEND_ACC_EARLY_BINDING) {
1148 		uint32_t  first_early_binding_opline = (uint32_t)-1;
1149 		uint32_t *prev_opline_num = &first_early_binding_opline;
1150 		zend_op  *opline = op_array->opcodes;
1151 		zend_op  *end = opline + op_array->last;
1152 
1153 		while (opline < end) {
1154 			if (opline->opcode == ZEND_DECLARE_CLASS_DELAYED) {
1155 				*prev_opline_num = opline - op_array->opcodes;
1156 				prev_opline_num = &opline->result.opline_num;
1157 			}
1158 			++opline;
1159 		}
1160 		*prev_opline_num = -1;
1161 		return first_early_binding_opline;
1162 	}
1163 	return (uint32_t)-1;
1164 }
1165 /* }}} */
1166 
zend_do_delayed_early_binding(zend_op_array *op_array, uint32_t first_early_binding_opline)1167 ZEND_API void zend_do_delayed_early_binding(zend_op_array *op_array, uint32_t first_early_binding_opline) /* {{{ */
1168 {
1169 	if (first_early_binding_opline != (uint32_t)-1) {
1170 		zend_bool orig_in_compilation = CG(in_compilation);
1171 		uint32_t opline_num = first_early_binding_opline;
1172 		void **run_time_cache;
1173 
1174 		if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
1175 			void *ptr;
1176 
1177 			ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
1178 			ptr = emalloc(op_array->cache_size + sizeof(void*));
1179 			ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
1180 			ptr = (char*)ptr + sizeof(void*);
1181 			ZEND_MAP_PTR_SET(op_array->run_time_cache, ptr);
1182 			memset(ptr, 0, op_array->cache_size);
1183 		}
1184 		run_time_cache = RUN_TIME_CACHE(op_array);
1185 
1186 		CG(in_compilation) = 1;
1187 		while (opline_num != (uint32_t)-1) {
1188 			const zend_op *opline = &op_array->opcodes[opline_num];
1189 			zval *lcname = RT_CONSTANT(opline, opline->op1);
1190 			zval *zv = zend_hash_find_ex(EG(class_table), Z_STR_P(lcname + 1), 1);
1191 
1192 			if (zv) {
1193 				zend_class_entry *ce = Z_CE_P(zv);
1194 				zend_string *lc_parent_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1195 				zend_class_entry *parent_ce = zend_hash_find_ex_ptr(EG(class_table), lc_parent_name, 1);
1196 
1197 				if (parent_ce) {
1198 					if (zend_try_early_bind(ce, parent_ce, Z_STR_P(lcname), zv)) {
1199 						/* Store in run-time cache */
1200 						((void**)((char*)run_time_cache + opline->extended_value))[0] = ce;
1201 					}
1202 				}
1203 			}
1204 			opline_num = op_array->opcodes[opline_num].result.opline_num;
1205 		}
1206 		CG(in_compilation) = orig_in_compilation;
1207 	}
1208 }
1209 /* }}} */
1210 
zend_mangle_property_name(const char *src1, size_t src1_length, const char *src2, size_t src2_length, int internal)1211 ZEND_API zend_string *zend_mangle_property_name(const char *src1, size_t src1_length, const char *src2, size_t src2_length, int internal) /* {{{ */
1212 {
1213 	size_t prop_name_length = 1 + src1_length + 1 + src2_length;
1214 	zend_string *prop_name = zend_string_alloc(prop_name_length, internal);
1215 
1216 	ZSTR_VAL(prop_name)[0] = '\0';
1217 	memcpy(ZSTR_VAL(prop_name) + 1, src1, src1_length+1);
1218 	memcpy(ZSTR_VAL(prop_name) + 1 + src1_length + 1, src2, src2_length+1);
1219 	return prop_name;
1220 }
1221 /* }}} */
1222 
zend_strnlen(const char* s, size_t maxlen)1223 static zend_always_inline size_t zend_strnlen(const char* s, size_t maxlen) /* {{{ */
1224 {
1225 	size_t len = 0;
1226 	while (*s++ && maxlen--) len++;
1227 	return len;
1228 }
1229 /* }}} */
1230 
zend_unmangle_property_name_ex(const zend_string *name, const char **class_name, const char **prop_name, size_t *prop_len)1231 ZEND_API int zend_unmangle_property_name_ex(const zend_string *name, const char **class_name, const char **prop_name, size_t *prop_len) /* {{{ */
1232 {
1233 	size_t class_name_len;
1234 	size_t anonclass_src_len;
1235 
1236 	*class_name = NULL;
1237 
1238 	if (!ZSTR_LEN(name) || ZSTR_VAL(name)[0] != '\0') {
1239 		*prop_name = ZSTR_VAL(name);
1240 		if (prop_len) {
1241 			*prop_len = ZSTR_LEN(name);
1242 		}
1243 		return SUCCESS;
1244 	}
1245 	if (ZSTR_LEN(name) < 3 || ZSTR_VAL(name)[1] == '\0') {
1246 		zend_error(E_NOTICE, "Illegal member variable name");
1247 		*prop_name = ZSTR_VAL(name);
1248 		if (prop_len) {
1249 			*prop_len = ZSTR_LEN(name);
1250 		}
1251 		return FAILURE;
1252 	}
1253 
1254 	class_name_len = zend_strnlen(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 2);
1255 	if (class_name_len >= ZSTR_LEN(name) - 2 || ZSTR_VAL(name)[class_name_len + 1] != '\0') {
1256 		zend_error(E_NOTICE, "Corrupt member variable name");
1257 		*prop_name = ZSTR_VAL(name);
1258 		if (prop_len) {
1259 			*prop_len = ZSTR_LEN(name);
1260 		}
1261 		return FAILURE;
1262 	}
1263 
1264 	*class_name = ZSTR_VAL(name) + 1;
1265 	anonclass_src_len = zend_strnlen(*class_name + class_name_len + 1, ZSTR_LEN(name) - class_name_len - 2);
1266 	if (class_name_len + anonclass_src_len + 2 != ZSTR_LEN(name)) {
1267 		class_name_len += anonclass_src_len + 1;
1268 	}
1269 	*prop_name = ZSTR_VAL(name) + class_name_len + 2;
1270 	if (prop_len) {
1271 		*prop_len = ZSTR_LEN(name) - class_name_len - 2;
1272 	}
1273 	return SUCCESS;
1274 }
1275 /* }}} */
1276 
zend_lookup_reserved_const(const char *name, size_t len)1277 static zend_constant *zend_lookup_reserved_const(const char *name, size_t len) /* {{{ */
1278 {
1279 	zend_constant *c = zend_hash_find_ptr_lc(EG(zend_constants), name, len);
1280 	if (c && !(ZEND_CONSTANT_FLAGS(c) & CONST_CS) && (ZEND_CONSTANT_FLAGS(c) & CONST_CT_SUBST)) {
1281 		return c;
1282 	}
1283 	return NULL;
1284 }
1285 /* }}} */
1286 
zend_try_ct_eval_const(zval *zv, zend_string *name, zend_bool is_fully_qualified)1287 static zend_bool zend_try_ct_eval_const(zval *zv, zend_string *name, zend_bool is_fully_qualified) /* {{{ */
1288 {
1289 	zend_constant *c;
1290 
1291 	/* Substitute case-sensitive (or lowercase) constants */
1292 	c = zend_hash_find_ptr(EG(zend_constants), name);
1293 	if (c && (
1294 	      ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
1295 	      && !(CG(compiler_options) & ZEND_COMPILE_NO_PERSISTENT_CONSTANT_SUBSTITUTION)
1296 	      && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE) || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE)))
1297 	   || (Z_TYPE(c->value) < IS_OBJECT && !(CG(compiler_options) & ZEND_COMPILE_NO_CONSTANT_SUBSTITUTION))
1298 	)) {
1299 		ZVAL_COPY_OR_DUP(zv, &c->value);
1300 		return 1;
1301 	}
1302 
1303 	{
1304 		/* Substitute true, false and null (including unqualified usage in namespaces) */
1305 		const char *lookup_name = ZSTR_VAL(name);
1306 		size_t lookup_len = ZSTR_LEN(name);
1307 
1308 		if (!is_fully_qualified) {
1309 			zend_get_unqualified_name(name, &lookup_name, &lookup_len);
1310 		}
1311 
1312 		c = zend_lookup_reserved_const(lookup_name, lookup_len);
1313 		if (c) {
1314 			ZVAL_COPY_OR_DUP(zv, &c->value);
1315 			return 1;
1316 		}
1317 	}
1318 
1319 	return 0;
1320 }
1321 /* }}} */
1322 
zend_is_scope_knownnull1323 static inline zend_bool zend_is_scope_known() /* {{{ */
1324 {
1325 	if (CG(active_op_array)->fn_flags & ZEND_ACC_CLOSURE) {
1326 		/* Closures can be rebound to a different scope */
1327 		return 0;
1328 	}
1329 
1330 	if (!CG(active_class_entry)) {
1331 		/* The scope is known if we're in a free function (no scope), but not if we're in
1332 		 * a file/eval (which inherits including/eval'ing scope). */
1333 		return CG(active_op_array)->function_name != NULL;
1334 	}
1335 
1336 	/* For traits self etc refers to the using class, not the trait itself */
1337 	return (CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) == 0;
1338 }
1339 /* }}} */
1340 
class_name_refers_to_active_ce(zend_string *class_name, uint32_t fetch_type)1341 static inline zend_bool class_name_refers_to_active_ce(zend_string *class_name, uint32_t fetch_type) /* {{{ */
1342 {
1343 	if (!CG(active_class_entry)) {
1344 		return 0;
1345 	}
1346 	if (fetch_type == ZEND_FETCH_CLASS_SELF && zend_is_scope_known()) {
1347 		return 1;
1348 	}
1349 	return fetch_type == ZEND_FETCH_CLASS_DEFAULT
1350 		&& zend_string_equals_ci(class_name, CG(active_class_entry)->name);
1351 }
1352 /* }}} */
1353 
zend_get_class_fetch_type(zend_string *name)1354 uint32_t zend_get_class_fetch_type(zend_string *name) /* {{{ */
1355 {
1356 	if (zend_string_equals_literal_ci(name, "self")) {
1357 		return ZEND_FETCH_CLASS_SELF;
1358 	} else if (zend_string_equals_literal_ci(name, "parent")) {
1359 		return ZEND_FETCH_CLASS_PARENT;
1360 	} else if (zend_string_equals_literal_ci(name, "static")) {
1361 		return ZEND_FETCH_CLASS_STATIC;
1362 	} else {
1363 		return ZEND_FETCH_CLASS_DEFAULT;
1364 	}
1365 }
1366 /* }}} */
1367 
zend_get_class_fetch_type_ast(zend_ast *name_ast)1368 static uint32_t zend_get_class_fetch_type_ast(zend_ast *name_ast) /* {{{ */
1369 {
1370 	/* Fully qualified names are always default refs */
1371 	if (name_ast->attr == ZEND_NAME_FQ) {
1372 		return ZEND_FETCH_CLASS_DEFAULT;
1373 	}
1374 
1375 	return zend_get_class_fetch_type(zend_ast_get_str(name_ast));
1376 }
1377 /* }}} */
1378 
zend_ensure_valid_class_fetch_type(uint32_t fetch_type)1379 static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
1380 {
1381 	if (fetch_type != ZEND_FETCH_CLASS_DEFAULT && zend_is_scope_known()) {
1382 		zend_class_entry *ce = CG(active_class_entry);
1383 		if (!ce) {
1384 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use \"%s\" when no class scope is active",
1385 				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
1386 				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
1387 		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT && !ce->parent_name) {
1388 			zend_error(E_DEPRECATED,
1389 				"Cannot use \"parent\" when current class scope has no parent");
1390 		}
1391 	}
1392 }
1393 /* }}} */
1394 
zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast)1395 static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast) /* {{{ */
1396 {
1397 	uint32_t fetch_type;
1398 	zval *class_name;
1399 
1400 	if (class_ast->kind != ZEND_AST_ZVAL) {
1401 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use ::class with dynamic class name");
1402 	}
1403 
1404 	class_name = zend_ast_get_zval(class_ast);
1405 
1406 	if (Z_TYPE_P(class_name) != IS_STRING) {
1407 		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
1408 	}
1409 
1410 	fetch_type = zend_get_class_fetch_type(Z_STR_P(class_name));
1411 	zend_ensure_valid_class_fetch_type(fetch_type);
1412 
1413 	switch (fetch_type) {
1414 		case ZEND_FETCH_CLASS_SELF:
1415 			if (CG(active_class_entry) && zend_is_scope_known()) {
1416 				ZVAL_STR_COPY(zv, CG(active_class_entry)->name);
1417 				return 1;
1418 			}
1419 			return 0;
1420 		case ZEND_FETCH_CLASS_PARENT:
1421 			if (CG(active_class_entry) && CG(active_class_entry)->parent_name
1422 					&& zend_is_scope_known()) {
1423 				ZVAL_STR_COPY(zv, CG(active_class_entry)->parent_name);
1424 				return 1;
1425 			}
1426 			return 0;
1427 		case ZEND_FETCH_CLASS_STATIC:
1428 			return 0;
1429 		case ZEND_FETCH_CLASS_DEFAULT:
1430 			ZVAL_STR(zv, zend_resolve_class_name_ast(class_ast));
1431 			return 1;
1432 		EMPTY_SWITCH_DEFAULT_CASE()
1433 	}
1434 }
1435 /* }}} */
1436 
1437 /* We don't use zend_verify_const_access because we need to deal with unlinked classes. */
zend_verify_ct_const_access(zend_class_constant *c, zend_class_entry *scope)1438 static zend_bool zend_verify_ct_const_access(zend_class_constant *c, zend_class_entry *scope)
1439 {
1440 	if (Z_ACCESS_FLAGS(c->value) & ZEND_ACC_PUBLIC) {
1441 		return 1;
1442 	} else if (Z_ACCESS_FLAGS(c->value) & ZEND_ACC_PRIVATE) {
1443 		return c->ce == scope;
1444 	} else {
1445 		zend_class_entry *ce = c->ce;
1446 		while (1) {
1447 			if (ce == scope) {
1448 				return 1;
1449 			}
1450 			if (!ce->parent) {
1451 				break;
1452 			}
1453 			if (ce->ce_flags & ZEND_ACC_RESOLVED_PARENT) {
1454 				ce = ce->parent;
1455 			} else {
1456 				ce = zend_hash_find_ptr_lc(CG(class_table), ZSTR_VAL(ce->parent_name), ZSTR_LEN(ce->parent_name));
1457 				if (!ce) {
1458 					break;
1459 				}
1460 			}
1461 		}
1462 		/* Reverse case cannot be true during compilation */
1463 		return 0;
1464 	}
1465 }
1466 
zend_try_ct_eval_class_const(zval *zv, zend_string *class_name, zend_string *name)1467 static zend_bool zend_try_ct_eval_class_const(zval *zv, zend_string *class_name, zend_string *name) /* {{{ */
1468 {
1469 	uint32_t fetch_type = zend_get_class_fetch_type(class_name);
1470 	zend_class_constant *cc;
1471 	zval *c;
1472 
1473 	if (class_name_refers_to_active_ce(class_name, fetch_type)) {
1474 		cc = zend_hash_find_ptr(&CG(active_class_entry)->constants_table, name);
1475 	} else if (fetch_type == ZEND_FETCH_CLASS_DEFAULT && !(CG(compiler_options) & ZEND_COMPILE_NO_CONSTANT_SUBSTITUTION)) {
1476 		zend_class_entry *ce = zend_hash_find_ptr_lc(CG(class_table), ZSTR_VAL(class_name), ZSTR_LEN(class_name));
1477 		if (ce) {
1478 			cc = zend_hash_find_ptr(&ce->constants_table, name);
1479 		} else {
1480 			return 0;
1481 		}
1482 	} else {
1483 		return 0;
1484 	}
1485 
1486 	if (CG(compiler_options) & ZEND_COMPILE_NO_PERSISTENT_CONSTANT_SUBSTITUTION) {
1487 		return 0;
1488 	}
1489 
1490 	if (!cc || !zend_verify_ct_const_access(cc, CG(active_class_entry))) {
1491 		return 0;
1492 	}
1493 
1494 	c = &cc->value;
1495 
1496 	/* Substitute case-sensitive (or lowercase) persistent class constants */
1497 	if (Z_TYPE_P(c) < IS_OBJECT) {
1498 		ZVAL_COPY_OR_DUP(zv, c);
1499 		return 1;
1500 	}
1501 
1502 	return 0;
1503 }
1504 /* }}} */
1505 
zend_add_to_list(void *result, void *item)1506 static void zend_add_to_list(void *result, void *item) /* {{{ */
1507 {
1508 	void** list = *(void**)result;
1509 	size_t n = 0;
1510 
1511 	if (list) {
1512 		while (list[n]) {
1513 			n++;
1514 		}
1515 	}
1516 
1517 	list = erealloc(list, sizeof(void*) * (n+2));
1518 
1519 	list[n]   = item;
1520 	list[n+1] = NULL;
1521 
1522 	*(void**)result = list;
1523 }
1524 /* }}} */
1525 
zend_do_extended_stmt(void)1526 void zend_do_extended_stmt(void) /* {{{ */
1527 {
1528 	zend_op *opline;
1529 
1530 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT)) {
1531 		return;
1532 	}
1533 
1534 	opline = get_next_op();
1535 
1536 	opline->opcode = ZEND_EXT_STMT;
1537 }
1538 /* }}} */
1539 
zend_do_extended_fcall_begin(void)1540 void zend_do_extended_fcall_begin(void) /* {{{ */
1541 {
1542 	zend_op *opline;
1543 
1544 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_FCALL)) {
1545 		return;
1546 	}
1547 
1548 	opline = get_next_op();
1549 
1550 	opline->opcode = ZEND_EXT_FCALL_BEGIN;
1551 }
1552 /* }}} */
1553 
zend_do_extended_fcall_end(void)1554 void zend_do_extended_fcall_end(void) /* {{{ */
1555 {
1556 	zend_op *opline;
1557 
1558 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_FCALL)) {
1559 		return;
1560 	}
1561 
1562 	opline = get_next_op();
1563 
1564 	opline->opcode = ZEND_EXT_FCALL_END;
1565 }
1566 /* }}} */
1567 
zend_is_auto_global_str(char *name, size_t len)1568 zend_bool zend_is_auto_global_str(char *name, size_t len) /* {{{ */ {
1569 	zend_auto_global *auto_global;
1570 
1571 	if ((auto_global = zend_hash_str_find_ptr(CG(auto_globals), name, len)) != NULL) {
1572 		if (auto_global->armed) {
1573 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1574 		}
1575 		return 1;
1576 	}
1577 	return 0;
1578 }
1579 /* }}} */
1580 
zend_is_auto_global(zend_string *name)1581 zend_bool zend_is_auto_global(zend_string *name) /* {{{ */
1582 {
1583 	zend_auto_global *auto_global;
1584 
1585 	if ((auto_global = zend_hash_find_ptr(CG(auto_globals), name)) != NULL) {
1586 		if (auto_global->armed) {
1587 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1588 		}
1589 		return 1;
1590 	}
1591 	return 0;
1592 }
1593 /* }}} */
1594 
zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global_callback auto_global_callback)1595 int zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global_callback auto_global_callback) /* {{{ */
1596 {
1597 	zend_auto_global auto_global;
1598 	int retval;
1599 
1600 	auto_global.name = name;
1601 	auto_global.auto_global_callback = auto_global_callback;
1602 	auto_global.jit = jit;
1603 
1604 	retval = zend_hash_add_mem(CG(auto_globals), auto_global.name, &auto_global, sizeof(zend_auto_global)) != NULL ? SUCCESS : FAILURE;
1605 
1606 	return retval;
1607 }
1608 /* }}} */
1609 
zend_activate_auto_globals(void)1610 ZEND_API void zend_activate_auto_globals(void) /* {{{ */
1611 {
1612 	zend_auto_global *auto_global;
1613 
1614 	ZEND_HASH_FOREACH_PTR(CG(auto_globals), auto_global) {
1615 		if (auto_global->jit) {
1616 			auto_global->armed = 1;
1617 		} else if (auto_global->auto_global_callback) {
1618 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1619 		} else {
1620 			auto_global->armed = 0;
1621 		}
1622 	} ZEND_HASH_FOREACH_END();
1623 }
1624 /* }}} */
1625 
zendlex(zend_parser_stack_elem *elem)1626 int ZEND_FASTCALL zendlex(zend_parser_stack_elem *elem) /* {{{ */
1627 {
1628 	zval zv;
1629 	int ret;
1630 
1631 	if (CG(increment_lineno)) {
1632 		CG(zend_lineno)++;
1633 		CG(increment_lineno) = 0;
1634 	}
1635 
1636 	ret = lex_scan(&zv, elem);
1637 	ZEND_ASSERT(!EG(exception) || ret == T_ERROR);
1638 	return ret;
1639 
1640 }
1641 /* }}} */
1642 
zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers)1643 ZEND_API void zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers) /* {{{ */
1644 {
1645 	zend_bool persistent_hashes = ce->type == ZEND_INTERNAL_CLASS;
1646 
1647 	ce->refcount = 1;
1648 	ce->ce_flags = ZEND_ACC_CONSTANTS_UPDATED;
1649 
1650 	if (CG(compiler_options) & ZEND_COMPILE_GUARDS) {
1651 		ce->ce_flags |= ZEND_ACC_USE_GUARDS;
1652 	}
1653 
1654 	ce->default_properties_table = NULL;
1655 	ce->default_static_members_table = NULL;
1656 	zend_hash_init_ex(&ce->properties_info, 8, NULL, (persistent_hashes ? zend_destroy_property_info_internal : NULL), persistent_hashes, 0);
1657 	zend_hash_init_ex(&ce->constants_table, 8, NULL, NULL, persistent_hashes, 0);
1658 	zend_hash_init_ex(&ce->function_table, 8, NULL, ZEND_FUNCTION_DTOR, persistent_hashes, 0);
1659 
1660 	if (ce->type == ZEND_INTERNAL_CLASS) {
1661 		ZEND_MAP_PTR_INIT(ce->static_members_table, NULL);
1662 	} else {
1663 		ZEND_MAP_PTR_INIT(ce->static_members_table, &ce->default_static_members_table);
1664 		ce->info.user.doc_comment = NULL;
1665 	}
1666 
1667 	ce->default_properties_count = 0;
1668 	ce->default_static_members_count = 0;
1669 	ce->properties_info_table = NULL;
1670 
1671 	if (nullify_handlers) {
1672 		ce->constructor = NULL;
1673 		ce->destructor = NULL;
1674 		ce->clone = NULL;
1675 		ce->__get = NULL;
1676 		ce->__set = NULL;
1677 		ce->__unset = NULL;
1678 		ce->__isset = NULL;
1679 		ce->__call = NULL;
1680 		ce->__callstatic = NULL;
1681 		ce->__tostring = NULL;
1682 		ce->create_object = NULL;
1683 		ce->get_iterator = NULL;
1684 		ce->iterator_funcs_ptr = NULL;
1685 		ce->get_static_method = NULL;
1686 		ce->parent = NULL;
1687 		ce->parent_name = NULL;
1688 		ce->num_interfaces = 0;
1689 		ce->interfaces = NULL;
1690 		ce->num_traits = 0;
1691 		ce->trait_names = NULL;
1692 		ce->trait_aliases = NULL;
1693 		ce->trait_precedences = NULL;
1694 		ce->serialize = NULL;
1695 		ce->unserialize = NULL;
1696 		ce->serialize_func = NULL;
1697 		ce->unserialize_func = NULL;
1698 		ce->__debugInfo = NULL;
1699 		if (ce->type == ZEND_INTERNAL_CLASS) {
1700 			ce->info.internal.module = NULL;
1701 			ce->info.internal.builtin_functions = NULL;
1702 		}
1703 	}
1704 }
1705 /* }}} */
1706 
zend_get_compiled_variable_name(const zend_op_array *op_array, uint32_t var)1707 ZEND_API zend_string *zend_get_compiled_variable_name(const zend_op_array *op_array, uint32_t var) /* {{{ */
1708 {
1709 	return op_array->vars[EX_VAR_TO_NUM(var)];
1710 }
1711 /* }}} */
1712 
zend_ast_append_str(zend_ast *left_ast, zend_ast *right_ast)1713 zend_ast *zend_ast_append_str(zend_ast *left_ast, zend_ast *right_ast) /* {{{ */
1714 {
1715 	zval *left_zv = zend_ast_get_zval(left_ast);
1716 	zend_string *left = Z_STR_P(left_zv);
1717 	zend_string *right = zend_ast_get_str(right_ast);
1718 
1719 	zend_string *result;
1720 	size_t left_len = ZSTR_LEN(left);
1721 	size_t len = left_len + ZSTR_LEN(right) + 1; /* left\right */
1722 
1723 	result = zend_string_extend(left, len, 0);
1724 	ZSTR_VAL(result)[left_len] = '\\';
1725 	memcpy(&ZSTR_VAL(result)[left_len + 1], ZSTR_VAL(right), ZSTR_LEN(right));
1726 	ZSTR_VAL(result)[len] = '\0';
1727 	zend_string_release_ex(right, 0);
1728 
1729 	ZVAL_STR(left_zv, result);
1730 	return left_ast;
1731 }
1732 /* }}} */
1733 
zend_negate_num_string(zend_ast *ast)1734 zend_ast *zend_negate_num_string(zend_ast *ast) /* {{{ */
1735 {
1736 	zval *zv = zend_ast_get_zval(ast);
1737 	if (Z_TYPE_P(zv) == IS_LONG) {
1738 		if (Z_LVAL_P(zv) == 0) {
1739 			ZVAL_NEW_STR(zv, zend_string_init("-0", sizeof("-0")-1, 0));
1740 		} else {
1741 			ZEND_ASSERT(Z_LVAL_P(zv) > 0);
1742 			Z_LVAL_P(zv) *= -1;
1743 		}
1744 	} else if (Z_TYPE_P(zv) == IS_STRING) {
1745 		size_t orig_len = Z_STRLEN_P(zv);
1746 		Z_STR_P(zv) = zend_string_extend(Z_STR_P(zv), orig_len + 1, 0);
1747 		memmove(Z_STRVAL_P(zv) + 1, Z_STRVAL_P(zv), orig_len + 1);
1748 		Z_STRVAL_P(zv)[0] = '-';
1749 	} else {
1750 		ZEND_ASSERT(0);
1751 	}
1752 	return ast;
1753 }
1754 /* }}} */
1755 
zend_verify_namespace(void)1756 void zend_verify_namespace(void) /* {{{ */
1757 {
1758 	if (FC(has_bracketed_namespaces) && !FC(in_namespace)) {
1759 		zend_error_noreturn(E_COMPILE_ERROR, "No code may exist outside of namespace {}");
1760 	}
1761 }
1762 /* }}} */
1763 
1764 /* {{{ zend_dirname
1765    Returns directory name component of path */
zend_dirname(char *path, size_t len)1766 ZEND_API size_t zend_dirname(char *path, size_t len)
1767 {
1768 	register char *end = path + len - 1;
1769 	unsigned int len_adjust = 0;
1770 
1771 #ifdef ZEND_WIN32
1772 	/* Note that on Win32 CWD is per drive (heritage from CP/M).
1773 	 * This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive.
1774 	 */
1775 	if ((2 <= len) && isalpha((int)((unsigned char *)path)[0]) && (':' == path[1])) {
1776 		/* Skip over the drive spec (if any) so as not to change */
1777 		path += 2;
1778 		len_adjust += 2;
1779 		if (2 == len) {
1780 			/* Return "c:" on Win32 for dirname("c:").
1781 			 * It would be more consistent to return "c:."
1782 			 * but that would require making the string *longer*.
1783 			 */
1784 			return len;
1785 		}
1786 	}
1787 #endif
1788 
1789 	if (len == 0) {
1790 		/* Illegal use of this function */
1791 		return 0;
1792 	}
1793 
1794 	/* Strip trailing slashes */
1795 	while (end >= path && IS_SLASH_P(end)) {
1796 		end--;
1797 	}
1798 	if (end < path) {
1799 		/* The path only contained slashes */
1800 		path[0] = DEFAULT_SLASH;
1801 		path[1] = '\0';
1802 		return 1 + len_adjust;
1803 	}
1804 
1805 	/* Strip filename */
1806 	while (end >= path && !IS_SLASH_P(end)) {
1807 		end--;
1808 	}
1809 	if (end < path) {
1810 		/* No slash found, therefore return '.' */
1811 		path[0] = '.';
1812 		path[1] = '\0';
1813 		return 1 + len_adjust;
1814 	}
1815 
1816 	/* Strip slashes which came before the file name */
1817 	while (end >= path && IS_SLASH_P(end)) {
1818 		end--;
1819 	}
1820 	if (end < path) {
1821 		path[0] = DEFAULT_SLASH;
1822 		path[1] = '\0';
1823 		return 1 + len_adjust;
1824 	}
1825 	*(end+1) = '\0';
1826 
1827 	return (size_t)(end + 1 - path) + len_adjust;
1828 }
1829 /* }}} */
1830 
zend_adjust_for_fetch_type(zend_op *opline, znode *result, uint32_t type)1831 static void zend_adjust_for_fetch_type(zend_op *opline, znode *result, uint32_t type) /* {{{ */
1832 {
1833 	zend_uchar factor = (opline->opcode == ZEND_FETCH_STATIC_PROP_R) ? 1 : 3;
1834 
1835 	switch (type) {
1836 		case BP_VAR_R:
1837 			opline->result_type = IS_TMP_VAR;
1838 			result->op_type = IS_TMP_VAR;
1839 			return;
1840 		case BP_VAR_W:
1841 			opline->opcode += 1 * factor;
1842 			return;
1843 		case BP_VAR_RW:
1844 			opline->opcode += 2 * factor;
1845 			return;
1846 		case BP_VAR_IS:
1847 			opline->result_type = IS_TMP_VAR;
1848 			result->op_type = IS_TMP_VAR;
1849 			opline->opcode += 3 * factor;
1850 			return;
1851 		case BP_VAR_FUNC_ARG:
1852 			opline->opcode += 4 * factor;
1853 			return;
1854 		case BP_VAR_UNSET:
1855 			opline->opcode += 5 * factor;
1856 			return;
1857 		EMPTY_SWITCH_DEFAULT_CASE()
1858 	}
1859 }
1860 /* }}} */
1861 
zend_make_var_result(znode *result, zend_op *opline)1862 static inline void zend_make_var_result(znode *result, zend_op *opline) /* {{{ */
1863 {
1864 	opline->result_type = IS_VAR;
1865 	opline->result.var = get_temporary_variable();
1866 	GET_NODE(result, opline->result);
1867 }
1868 /* }}} */
1869 
zend_make_tmp_result(znode *result, zend_op *opline)1870 static inline void zend_make_tmp_result(znode *result, zend_op *opline) /* {{{ */
1871 {
1872 	opline->result_type = IS_TMP_VAR;
1873 	opline->result.var = get_temporary_variable();
1874 	GET_NODE(result, opline->result);
1875 }
1876 /* }}} */
1877 
zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2)1878 static zend_op *zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
1879 {
1880 	zend_op *opline = get_next_op();
1881 	opline->opcode = opcode;
1882 
1883 	if (op1 != NULL) {
1884 		SET_NODE(opline->op1, op1);
1885 	}
1886 
1887 	if (op2 != NULL) {
1888 		SET_NODE(opline->op2, op2);
1889 	}
1890 
1891 	if (result) {
1892 		zend_make_var_result(result, opline);
1893 	}
1894 	return opline;
1895 }
1896 /* }}} */
1897 
zend_emit_op_tmp(znode *result, zend_uchar opcode, znode *op1, znode *op2)1898 static zend_op *zend_emit_op_tmp(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
1899 {
1900 	zend_op *opline = get_next_op();
1901 	opline->opcode = opcode;
1902 
1903 	if (op1 != NULL) {
1904 		SET_NODE(opline->op1, op1);
1905 	}
1906 
1907 	if (op2 != NULL) {
1908 		SET_NODE(opline->op2, op2);
1909 	}
1910 
1911 	if (result) {
1912 		zend_make_tmp_result(result, opline);
1913 	}
1914 
1915 	return opline;
1916 }
1917 /* }}} */
1918 
zend_emit_tick(void)1919 static void zend_emit_tick(void) /* {{{ */
1920 {
1921 	zend_op *opline;
1922 
1923 	/* This prevents a double TICK generated by the parser statement of "declare()" */
1924 	if (CG(active_op_array)->last && CG(active_op_array)->opcodes[CG(active_op_array)->last - 1].opcode == ZEND_TICKS) {
1925 		return;
1926 	}
1927 
1928 	opline = get_next_op();
1929 
1930 	opline->opcode = ZEND_TICKS;
1931 	opline->extended_value = FC(declarables).ticks;
1932 }
1933 /* }}} */
1934 
zend_emit_op_data(znode *value)1935 static inline zend_op *zend_emit_op_data(znode *value) /* {{{ */
1936 {
1937 	return zend_emit_op(NULL, ZEND_OP_DATA, value, NULL);
1938 }
1939 /* }}} */
1940 
zend_emit_jump(uint32_t opnum_target)1941 static inline uint32_t zend_emit_jump(uint32_t opnum_target) /* {{{ */
1942 {
1943 	uint32_t opnum = get_next_op_number();
1944 	zend_op *opline = zend_emit_op(NULL, ZEND_JMP, NULL, NULL);
1945 	opline->op1.opline_num = opnum_target;
1946 	return opnum;
1947 }
1948 /* }}} */
1949 
zend_is_smart_branch(zend_op *opline)1950 ZEND_API int zend_is_smart_branch(zend_op *opline) /* {{{ */
1951 {
1952 	switch (opline->opcode) {
1953 		case ZEND_IS_IDENTICAL:
1954 		case ZEND_IS_NOT_IDENTICAL:
1955 		case ZEND_IS_EQUAL:
1956 		case ZEND_IS_NOT_EQUAL:
1957 		case ZEND_IS_SMALLER:
1958 		case ZEND_IS_SMALLER_OR_EQUAL:
1959 		case ZEND_CASE:
1960 		case ZEND_ISSET_ISEMPTY_CV:
1961 		case ZEND_ISSET_ISEMPTY_VAR:
1962 		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1963 		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1964 		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1965 		case ZEND_INSTANCEOF:
1966 		case ZEND_TYPE_CHECK:
1967 		case ZEND_DEFINED:
1968 		case ZEND_IN_ARRAY:
1969 		case ZEND_ARRAY_KEY_EXISTS:
1970 			return 1;
1971 		default:
1972 			return 0;
1973 	}
1974 }
1975 /* }}} */
1976 
zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target)1977 static inline uint32_t zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target) /* {{{ */
1978 {
1979 	uint32_t opnum = get_next_op_number();
1980 	zend_op *opline;
1981 
1982 	if ((cond->op_type & (IS_CV|IS_CONST))
1983 	 && opnum > 0
1984 	 && zend_is_smart_branch(CG(active_op_array)->opcodes + opnum - 1)) {
1985 		/* emit extra NOP to avoid incorrect SMART_BRANCH in very rare cases */
1986 		zend_emit_op(NULL, ZEND_NOP, NULL, NULL);
1987 		opnum = get_next_op_number();
1988 	}
1989 	opline = zend_emit_op(NULL, opcode, cond, NULL);
1990 	opline->op2.opline_num = opnum_target;
1991 	return opnum;
1992 }
1993 /* }}} */
1994 
zend_update_jump_target(uint32_t opnum_jump, uint32_t opnum_target)1995 static inline void zend_update_jump_target(uint32_t opnum_jump, uint32_t opnum_target) /* {{{ */
1996 {
1997 	zend_op *opline = &CG(active_op_array)->opcodes[opnum_jump];
1998 	switch (opline->opcode) {
1999 		case ZEND_JMP:
2000 			opline->op1.opline_num = opnum_target;
2001 			break;
2002 		case ZEND_JMPZ:
2003 		case ZEND_JMPNZ:
2004 		case ZEND_JMPZ_EX:
2005 		case ZEND_JMPNZ_EX:
2006 		case ZEND_JMP_SET:
2007 		case ZEND_COALESCE:
2008 			opline->op2.opline_num = opnum_target;
2009 			break;
2010 		EMPTY_SWITCH_DEFAULT_CASE()
2011 	}
2012 }
2013 /* }}} */
2014 
zend_update_jump_target_to_next(uint32_t opnum_jump)2015 static inline void zend_update_jump_target_to_next(uint32_t opnum_jump) /* {{{ */
2016 {
2017 	zend_update_jump_target(opnum_jump, get_next_op_number());
2018 }
2019 /* }}} */
2020 
zend_delayed_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2)2021 static inline zend_op *zend_delayed_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
2022 {
2023 	zend_op tmp_opline;
2024 
2025 	init_op(&tmp_opline);
2026 
2027 	tmp_opline.opcode = opcode;
2028 	if (op1 != NULL) {
2029 		SET_NODE(tmp_opline.op1, op1);
2030 	}
2031 	if (op2 != NULL) {
2032 		SET_NODE(tmp_opline.op2, op2);
2033 	}
2034 	if (result) {
2035 		zend_make_var_result(result, &tmp_opline);
2036 	}
2037 
2038 	zend_stack_push(&CG(delayed_oplines_stack), &tmp_opline);
2039 	return zend_stack_top(&CG(delayed_oplines_stack));
2040 }
2041 /* }}} */
2042 
zend_delayed_compile_begin(void)2043 static inline uint32_t zend_delayed_compile_begin(void) /* {{{ */
2044 {
2045 	return zend_stack_count(&CG(delayed_oplines_stack));
2046 }
2047 /* }}} */
2048 
zend_delayed_compile_end(uint32_t offset)2049 static zend_op *zend_delayed_compile_end(uint32_t offset) /* {{{ */
2050 {
2051 	zend_op *opline = NULL, *oplines = zend_stack_base(&CG(delayed_oplines_stack));
2052 	uint32_t i, count = zend_stack_count(&CG(delayed_oplines_stack));
2053 
2054 	ZEND_ASSERT(count >= offset);
2055 	for (i = offset; i < count; ++i) {
2056 		opline = get_next_op();
2057 		memcpy(opline, &oplines[i], sizeof(zend_op));
2058 	}
2059 	CG(delayed_oplines_stack).top = offset;
2060 	return opline;
2061 }
2062 /* }}} */
2063 
2064 #define ZEND_MEMOIZE_NONE 0
2065 #define ZEND_MEMOIZE_COMPILE 1
2066 #define ZEND_MEMOIZE_FETCH 2
2067 
zend_compile_memoized_expr(znode *result, zend_ast *expr)2068 static void zend_compile_memoized_expr(znode *result, zend_ast *expr) /* {{{ */
2069 {
2070 	int memoize_mode = CG(memoize_mode);
2071 	if (memoize_mode == ZEND_MEMOIZE_COMPILE) {
2072 		znode memoized_result;
2073 
2074 		/* Go through normal compilation */
2075 		CG(memoize_mode) = ZEND_MEMOIZE_NONE;
2076 		zend_compile_expr(result, expr);
2077 		CG(memoize_mode) = ZEND_MEMOIZE_COMPILE;
2078 
2079 		if (result->op_type == IS_VAR) {
2080 			zend_emit_op(&memoized_result, ZEND_COPY_TMP, result, NULL);
2081 		} else if (result->op_type == IS_TMP_VAR) {
2082 			zend_emit_op_tmp(&memoized_result, ZEND_COPY_TMP, result, NULL);
2083 		} else {
2084 			if (result->op_type == IS_CONST) {
2085 				Z_TRY_ADDREF(result->u.constant);
2086 			}
2087 			memoized_result = *result;
2088 		}
2089 
2090 		zend_hash_index_update_mem(
2091 			CG(memoized_exprs), (uintptr_t) expr, &memoized_result, sizeof(znode));
2092 	} else if (memoize_mode == ZEND_MEMOIZE_FETCH) {
2093 		znode *memoized_result = zend_hash_index_find_ptr(CG(memoized_exprs), (uintptr_t) expr);
2094 		*result = *memoized_result;
2095 		if (result->op_type == IS_CONST) {
2096 			Z_TRY_ADDREF(result->u.constant);
2097 		}
2098 	} else {
2099 		ZEND_ASSERT(0);
2100 	}
2101 }
2102 /* }}} */
2103 
zend_emit_return_type_check( znode *expr, zend_arg_info *return_info, zend_bool implicit)2104 static void zend_emit_return_type_check(
2105 		znode *expr, zend_arg_info *return_info, zend_bool implicit) /* {{{ */
2106 {
2107 	if (ZEND_TYPE_IS_SET(return_info->type)) {
2108 		zend_op *opline;
2109 
2110 		/* `return ...;` is illegal in a void function (but `return;` isn't) */
2111 		if (ZEND_TYPE_CODE(return_info->type) == IS_VOID) {
2112 			if (expr) {
2113 				if (expr->op_type == IS_CONST && Z_TYPE(expr->u.constant) == IS_NULL) {
2114 					zend_error_noreturn(E_COMPILE_ERROR,
2115 						"A void function must not return a value "
2116 						"(did you mean \"return;\" instead of \"return null;\"?)");
2117 				} else {
2118 					zend_error_noreturn(E_COMPILE_ERROR, "A void function must not return a value");
2119 				}
2120 			}
2121 			/* we don't need run-time check */
2122 			return;
2123 		}
2124 
2125 		if (!expr && !implicit) {
2126 			if (ZEND_TYPE_ALLOW_NULL(return_info->type)) {
2127 				zend_error_noreturn(E_COMPILE_ERROR,
2128 					"A function with return type must return a value "
2129 					"(did you mean \"return null;\" instead of \"return;\"?)");
2130 			} else {
2131 				zend_error_noreturn(E_COMPILE_ERROR,
2132 					"A function with return type must return a value");
2133 			}
2134 		}
2135 
2136 		if (expr && expr->op_type == IS_CONST) {
2137 			if ((ZEND_TYPE_CODE(return_info->type) == Z_TYPE(expr->u.constant))
2138 			 ||((ZEND_TYPE_CODE(return_info->type) == _IS_BOOL)
2139 			  && (Z_TYPE(expr->u.constant) == IS_FALSE
2140 			   || Z_TYPE(expr->u.constant) == IS_TRUE))
2141 			 || (ZEND_TYPE_ALLOW_NULL(return_info->type)
2142 			  && Z_TYPE(expr->u.constant) == IS_NULL)) {
2143 				/* we don't need run-time check */
2144 				return;
2145 			}
2146 		}
2147 
2148 		opline = zend_emit_op(NULL, ZEND_VERIFY_RETURN_TYPE, expr, NULL);
2149 		if (expr && expr->op_type == IS_CONST) {
2150 			opline->result_type = expr->op_type = IS_TMP_VAR;
2151 			opline->result.var = expr->u.op.var = get_temporary_variable();
2152 		}
2153 		if (ZEND_TYPE_IS_CLASS(return_info->type)) {
2154 			opline->op2.num = CG(active_op_array)->cache_size;
2155 			CG(active_op_array)->cache_size += sizeof(void*);
2156 		} else {
2157 			opline->op2.num = -1;
2158 		}
2159 	}
2160 }
2161 /* }}} */
2162 
zend_emit_final_return(int return_one)2163 void zend_emit_final_return(int return_one) /* {{{ */
2164 {
2165 	znode zn;
2166 	zend_op *ret;
2167 	zend_bool returns_reference = (CG(active_op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
2168 
2169 	if (CG(active_op_array)->fn_flags & ZEND_ACC_HAS_RETURN_TYPE
2170 			&& !(CG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR)) {
2171 		zend_emit_return_type_check(NULL, CG(active_op_array)->arg_info - 1, 1);
2172 	}
2173 
2174 	zn.op_type = IS_CONST;
2175 	if (return_one) {
2176 		ZVAL_LONG(&zn.u.constant, 1);
2177 	} else {
2178 		ZVAL_NULL(&zn.u.constant);
2179 	}
2180 
2181 	ret = zend_emit_op(NULL, returns_reference ? ZEND_RETURN_BY_REF : ZEND_RETURN, &zn, NULL);
2182 	ret->extended_value = -1;
2183 }
2184 /* }}} */
2185 
zend_is_variable(zend_ast *ast)2186 static inline zend_bool zend_is_variable(zend_ast *ast) /* {{{ */
2187 {
2188 	return ast->kind == ZEND_AST_VAR || ast->kind == ZEND_AST_DIM
2189 		|| ast->kind == ZEND_AST_PROP || ast->kind == ZEND_AST_STATIC_PROP;
2190 }
2191 /* }}} */
2192 
zend_is_call(zend_ast *ast)2193 static inline zend_bool zend_is_call(zend_ast *ast) /* {{{ */
2194 {
2195 	return ast->kind == ZEND_AST_CALL
2196 		|| ast->kind == ZEND_AST_METHOD_CALL
2197 		|| ast->kind == ZEND_AST_STATIC_CALL;
2198 }
2199 /* }}} */
2200 
zend_is_variable_or_call(zend_ast *ast)2201 static inline zend_bool zend_is_variable_or_call(zend_ast *ast) /* {{{ */
2202 {
2203 	return zend_is_variable(ast) || zend_is_call(ast);
2204 }
2205 /* }}} */
2206 
zend_is_unticked_stmt(zend_ast *ast)2207 static inline zend_bool zend_is_unticked_stmt(zend_ast *ast) /* {{{ */
2208 {
2209 	return ast->kind == ZEND_AST_STMT_LIST || ast->kind == ZEND_AST_LABEL
2210 		|| ast->kind == ZEND_AST_PROP_DECL || ast->kind == ZEND_AST_CLASS_CONST_DECL
2211 		|| ast->kind == ZEND_AST_USE_TRAIT || ast->kind == ZEND_AST_METHOD;
2212 }
2213 /* }}} */
2214 
zend_can_write_to_variable(zend_ast *ast)2215 static inline zend_bool zend_can_write_to_variable(zend_ast *ast) /* {{{ */
2216 {
2217 	while (ast->kind == ZEND_AST_DIM || ast->kind == ZEND_AST_PROP) {
2218 		ast = ast->child[0];
2219 	}
2220 
2221 	return zend_is_variable_or_call(ast);
2222 }
2223 /* }}} */
2224 
zend_is_const_default_class_ref(zend_ast *name_ast)2225 static inline zend_bool zend_is_const_default_class_ref(zend_ast *name_ast) /* {{{ */
2226 {
2227 	if (name_ast->kind != ZEND_AST_ZVAL) {
2228 		return 0;
2229 	}
2230 
2231 	return ZEND_FETCH_CLASS_DEFAULT == zend_get_class_fetch_type_ast(name_ast);
2232 }
2233 /* }}} */
2234 
zend_handle_numeric_op(znode *node)2235 static inline void zend_handle_numeric_op(znode *node) /* {{{ */
2236 {
2237 	if (node->op_type == IS_CONST && Z_TYPE(node->u.constant) == IS_STRING) {
2238 		zend_ulong index;
2239 
2240 		if (ZEND_HANDLE_NUMERIC(Z_STR(node->u.constant), index)) {
2241 			zval_ptr_dtor(&node->u.constant);
2242 			ZVAL_LONG(&node->u.constant, index);
2243 		}
2244 	}
2245 }
2246 /* }}} */
2247 
zend_handle_numeric_dim(zend_op *opline, znode *dim_node)2248 static inline void zend_handle_numeric_dim(zend_op *opline, znode *dim_node) /* {{{ */
2249 {
2250 	if (Z_TYPE(dim_node->u.constant) == IS_STRING) {
2251 		zend_ulong index;
2252 
2253 		if (ZEND_HANDLE_NUMERIC(Z_STR(dim_node->u.constant), index)) {
2254 			/* For numeric indexes we also keep the original value to use by ArrayAccess
2255 			 * See bug #63217
2256 			 */
2257 			int c = zend_add_literal(&dim_node->u.constant);
2258 			ZEND_ASSERT(opline->op2.constant + 1 == c);
2259 			ZVAL_LONG(CT_CONSTANT(opline->op2), index);
2260 			Z_EXTRA_P(CT_CONSTANT(opline->op2)) = ZEND_EXTRA_VALUE;
2261 			return;
2262 		}
2263 	}
2264 }
2265 /* }}} */
2266 
zend_set_class_name_op1(zend_op *opline, znode *class_node)2267 static inline void zend_set_class_name_op1(zend_op *opline, znode *class_node) /* {{{ */
2268 {
2269 	if (class_node->op_type == IS_CONST) {
2270 		opline->op1_type = IS_CONST;
2271 		opline->op1.constant = zend_add_class_name_literal(
2272 			Z_STR(class_node->u.constant));
2273 	} else {
2274 		SET_NODE(opline->op1, class_node);
2275 	}
2276 }
2277 /* }}} */
2278 
zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags)2279 static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags) /* {{{ */
2280 {
2281 	uint32_t fetch_type;
2282 
2283 	if (name_ast->kind != ZEND_AST_ZVAL) {
2284 		znode name_node;
2285 
2286 		zend_compile_expr(&name_node, name_ast);
2287 
2288 		if (name_node.op_type == IS_CONST) {
2289 			zend_string *name;
2290 
2291 			if (Z_TYPE(name_node.u.constant) != IS_STRING) {
2292 				zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
2293 			}
2294 
2295 			name = Z_STR(name_node.u.constant);
2296 			fetch_type = zend_get_class_fetch_type(name);
2297 
2298 			if (fetch_type == ZEND_FETCH_CLASS_DEFAULT) {
2299 				result->op_type = IS_CONST;
2300 				ZVAL_STR(&result->u.constant, zend_resolve_class_name(name, ZEND_NAME_FQ));
2301 			} else {
2302 				zend_ensure_valid_class_fetch_type(fetch_type);
2303 				result->op_type = IS_UNUSED;
2304 				result->u.op.num = fetch_type | fetch_flags;
2305 			}
2306 
2307 			zend_string_release_ex(name, 0);
2308 		} else {
2309 			zend_op *opline = zend_emit_op(result, ZEND_FETCH_CLASS, NULL, &name_node);
2310 			opline->op1.num = ZEND_FETCH_CLASS_DEFAULT | fetch_flags;
2311 		}
2312 		return;
2313 	}
2314 
2315 	/* Fully qualified names are always default refs */
2316 	if (name_ast->attr == ZEND_NAME_FQ) {
2317 		result->op_type = IS_CONST;
2318 		ZVAL_STR(&result->u.constant, zend_resolve_class_name_ast(name_ast));
2319 		return;
2320 	}
2321 
2322 	fetch_type = zend_get_class_fetch_type(zend_ast_get_str(name_ast));
2323 	if (ZEND_FETCH_CLASS_DEFAULT == fetch_type) {
2324 		result->op_type = IS_CONST;
2325 		ZVAL_STR(&result->u.constant, zend_resolve_class_name_ast(name_ast));
2326 	} else {
2327 		zend_ensure_valid_class_fetch_type(fetch_type);
2328 		result->op_type = IS_UNUSED;
2329 		result->u.op.num = fetch_type | fetch_flags;
2330 	}
2331 }
2332 /* }}} */
2333 
zend_try_compile_cv(znode *result, zend_ast *ast)2334 static int zend_try_compile_cv(znode *result, zend_ast *ast) /* {{{ */
2335 {
2336 	zend_ast *name_ast = ast->child[0];
2337 	if (name_ast->kind == ZEND_AST_ZVAL) {
2338 		zval *zv = zend_ast_get_zval(name_ast);
2339 		zend_string *name;
2340 
2341 		if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
2342 			name = zval_make_interned_string(zv);
2343 		} else {
2344 			name = zend_new_interned_string(zval_get_string_func(zv));
2345 		}
2346 
2347 		if (zend_is_auto_global(name)) {
2348 			return FAILURE;
2349 		}
2350 
2351 		result->op_type = IS_CV;
2352 		result->u.op.var = lookup_cv(name);
2353 
2354 		if (UNEXPECTED(Z_TYPE_P(zv) != IS_STRING)) {
2355 			zend_string_release_ex(name, 0);
2356 		}
2357 
2358 		return SUCCESS;
2359 	}
2360 
2361 	return FAILURE;
2362 }
2363 /* }}} */
2364 
zend_compile_simple_var_no_cv(znode *result, zend_ast *ast, uint32_t type, int delayed)2365 static zend_op *zend_compile_simple_var_no_cv(znode *result, zend_ast *ast, uint32_t type, int delayed) /* {{{ */
2366 {
2367 	zend_ast *name_ast = ast->child[0];
2368 	znode name_node;
2369 	zend_op *opline;
2370 
2371 	zend_compile_expr(&name_node, name_ast);
2372 	if (name_node.op_type == IS_CONST) {
2373 		convert_to_string(&name_node.u.constant);
2374 	}
2375 
2376 	if (delayed) {
2377 		opline = zend_delayed_emit_op(result, ZEND_FETCH_R, &name_node, NULL);
2378 	} else {
2379 		opline = zend_emit_op(result, ZEND_FETCH_R, &name_node, NULL);
2380 	}
2381 
2382 	if (name_node.op_type == IS_CONST &&
2383 	    zend_is_auto_global(Z_STR(name_node.u.constant))) {
2384 
2385 		opline->extended_value = ZEND_FETCH_GLOBAL;
2386 	} else {
2387 		opline->extended_value = ZEND_FETCH_LOCAL;
2388 	}
2389 
2390 	zend_adjust_for_fetch_type(opline, result, type);
2391 	return opline;
2392 }
2393 /* }}} */
2394 
is_this_fetch(zend_ast *ast)2395 static zend_bool is_this_fetch(zend_ast *ast) /* {{{ */
2396 {
2397 	if (ast->kind == ZEND_AST_VAR && ast->child[0]->kind == ZEND_AST_ZVAL) {
2398 		zval *name = zend_ast_get_zval(ast->child[0]);
2399 		return Z_TYPE_P(name) == IS_STRING && zend_string_equals_literal(Z_STR_P(name), "this");
2400 	}
2401 
2402 	return 0;
2403 }
2404 /* }}} */
2405 
zend_compile_simple_var(znode *result, zend_ast *ast, uint32_t type, int delayed)2406 static zend_op *zend_compile_simple_var(znode *result, zend_ast *ast, uint32_t type, int delayed) /* {{{ */
2407 {
2408 	if (is_this_fetch(ast)) {
2409 		zend_op *opline = zend_emit_op(result, ZEND_FETCH_THIS, NULL, NULL);
2410 		if ((type == BP_VAR_R) || (type == BP_VAR_IS)) {
2411 			opline->result_type = IS_TMP_VAR;
2412 			result->op_type = IS_TMP_VAR;
2413 		}
2414 		CG(active_op_array)->fn_flags |= ZEND_ACC_USES_THIS;
2415 		return opline;
2416 	} else if (zend_try_compile_cv(result, ast) == FAILURE) {
2417 		return zend_compile_simple_var_no_cv(result, ast, type, delayed);
2418 	}
2419 	return NULL;
2420 }
2421 /* }}} */
2422 
zend_separate_if_call_and_write(znode *node, zend_ast *ast, uint32_t type)2423 static void zend_separate_if_call_and_write(znode *node, zend_ast *ast, uint32_t type) /* {{{ */
2424 {
2425 	if (type != BP_VAR_R && type != BP_VAR_IS && zend_is_call(ast)) {
2426 		if (node->op_type == IS_VAR) {
2427 			zend_op *opline = zend_emit_op(NULL, ZEND_SEPARATE, node, NULL);
2428 			opline->result_type = IS_VAR;
2429 			opline->result.var = opline->op1.var;
2430 		} else {
2431 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");
2432 		}
2433 	}
2434 }
2435 /* }}} */
2436 
2437 zend_op *zend_delayed_compile_var(znode *result, zend_ast *ast, uint32_t type, zend_bool by_ref);
2438 void zend_compile_assign(znode *result, zend_ast *ast);
2439 
zend_emit_assign_znode(zend_ast *var_ast, znode *value_node)2440 static inline void zend_emit_assign_znode(zend_ast *var_ast, znode *value_node) /* {{{ */
2441 {
2442 	znode dummy_node;
2443 	zend_ast *assign_ast = zend_ast_create(ZEND_AST_ASSIGN, var_ast,
2444 		zend_ast_create_znode(value_node));
2445 	zend_compile_assign(&dummy_node, assign_ast);
2446 	zend_do_free(&dummy_node);
2447 }
2448 /* }}} */
2449 
zend_delayed_compile_dim(znode *result, zend_ast *ast, uint32_t type)2450 static zend_op *zend_delayed_compile_dim(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2451 {
2452 	if (ast->attr == ZEND_DIM_ALTERNATIVE_SYNTAX) {
2453 		zend_error(E_DEPRECATED, "Array and string offset access syntax with curly braces is deprecated");
2454 	}
2455 
2456 	zend_ast *var_ast = ast->child[0];
2457 	zend_ast *dim_ast = ast->child[1];
2458 	zend_op *opline;
2459 
2460 	znode var_node, dim_node;
2461 
2462 	opline = zend_delayed_compile_var(&var_node, var_ast, type, 0);
2463 	if (opline && type == BP_VAR_W && (opline->opcode == ZEND_FETCH_STATIC_PROP_W || opline->opcode == ZEND_FETCH_OBJ_W)) {
2464 		opline->extended_value |= ZEND_FETCH_DIM_WRITE;
2465 	}
2466 
2467 	zend_separate_if_call_and_write(&var_node, var_ast, type);
2468 
2469 	if (dim_ast == NULL) {
2470 		if (type == BP_VAR_R || type == BP_VAR_IS) {
2471 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
2472 		}
2473 		if (type == BP_VAR_UNSET) {
2474 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for unsetting");
2475 		}
2476 		dim_node.op_type = IS_UNUSED;
2477 	} else {
2478 		zend_compile_expr(&dim_node, dim_ast);
2479 	}
2480 
2481 	opline = zend_delayed_emit_op(result, ZEND_FETCH_DIM_R, &var_node, &dim_node);
2482 	zend_adjust_for_fetch_type(opline, result, type);
2483 
2484 	if (dim_node.op_type == IS_CONST) {
2485 		zend_handle_numeric_dim(opline, &dim_node);
2486 	}
2487 	return opline;
2488 }
2489 /* }}} */
2490 
zend_compile_dim(znode *result, zend_ast *ast, uint32_t type)2491 static zend_op *zend_compile_dim(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2492 {
2493 	uint32_t offset = zend_delayed_compile_begin();
2494 	zend_delayed_compile_dim(result, ast, type);
2495 	return zend_delayed_compile_end(offset);
2496 }
2497 /* }}} */
2498 
zend_delayed_compile_prop(znode *result, zend_ast *ast, uint32_t type)2499 static zend_op *zend_delayed_compile_prop(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2500 {
2501 	zend_ast *obj_ast = ast->child[0];
2502 	zend_ast *prop_ast = ast->child[1];
2503 
2504 	znode obj_node, prop_node;
2505 	zend_op *opline;
2506 
2507 	if (is_this_fetch(obj_ast)) {
2508 		obj_node.op_type = IS_UNUSED;
2509 		CG(active_op_array)->fn_flags |= ZEND_ACC_USES_THIS;
2510 	} else {
2511 		opline = zend_delayed_compile_var(&obj_node, obj_ast, type, 0);
2512 		if (opline && type == BP_VAR_W && (opline->opcode == ZEND_FETCH_STATIC_PROP_W || opline->opcode == ZEND_FETCH_OBJ_W)) {
2513 			opline->extended_value |= ZEND_FETCH_OBJ_WRITE;
2514 		}
2515 
2516 		zend_separate_if_call_and_write(&obj_node, obj_ast, type);
2517 	}
2518 	zend_compile_expr(&prop_node, prop_ast);
2519 
2520 	opline = zend_delayed_emit_op(result, ZEND_FETCH_OBJ_R, &obj_node, &prop_node);
2521 	if (opline->op2_type == IS_CONST) {
2522 		convert_to_string(CT_CONSTANT(opline->op2));
2523 		opline->extended_value = zend_alloc_cache_slots(3);
2524 	}
2525 
2526 	zend_adjust_for_fetch_type(opline, result, type);
2527 	return opline;
2528 }
2529 /* }}} */
2530 
zend_compile_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref)2531 static zend_op *zend_compile_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref) /* {{{ */
2532 {
2533 	uint32_t offset = zend_delayed_compile_begin();
2534 	zend_op *opline = zend_delayed_compile_prop(result, ast, type);
2535 	if (by_ref) { /* shared with cache_slot */
2536 		opline->extended_value |= ZEND_FETCH_REF;
2537 	}
2538 	return zend_delayed_compile_end(offset);
2539 }
2540 /* }}} */
2541 
zend_compile_static_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref, int delayed)2542 zend_op *zend_compile_static_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref, int delayed) /* {{{ */
2543 {
2544 	zend_ast *class_ast = ast->child[0];
2545 	zend_ast *prop_ast = ast->child[1];
2546 
2547 	znode class_node, prop_node;
2548 	zend_op *opline;
2549 
2550 	zend_compile_class_ref(&class_node, class_ast, ZEND_FETCH_CLASS_EXCEPTION);
2551 
2552 	zend_compile_expr(&prop_node, prop_ast);
2553 
2554 	if (delayed) {
2555 		opline = zend_delayed_emit_op(result, ZEND_FETCH_STATIC_PROP_R, &prop_node, NULL);
2556 	} else {
2557 		opline = zend_emit_op(result, ZEND_FETCH_STATIC_PROP_R, &prop_node, NULL);
2558 	}
2559 	if (opline->op1_type == IS_CONST) {
2560 		convert_to_string(CT_CONSTANT(opline->op1));
2561 		opline->extended_value = zend_alloc_cache_slots(3);
2562 	}
2563 	if (class_node.op_type == IS_CONST) {
2564 		opline->op2_type = IS_CONST;
2565 		opline->op2.constant = zend_add_class_name_literal(
2566 			Z_STR(class_node.u.constant));
2567 		if (opline->op1_type != IS_CONST) {
2568 			opline->extended_value = zend_alloc_cache_slot();
2569 		}
2570 	} else {
2571 		SET_NODE(opline->op2, &class_node);
2572 	}
2573 
2574 	if (by_ref && (type == BP_VAR_W || type == BP_VAR_FUNC_ARG)) { /* shared with cache_slot */
2575 		opline->extended_value |= ZEND_FETCH_REF;
2576 	}
2577 
2578 	zend_adjust_for_fetch_type(opline, result, type);
2579 	return opline;
2580 }
2581 /* }}} */
2582 
zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_style)2583 static void zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_style) /* {{{ */ {
2584 	if (var_ast->kind == ZEND_AST_ARRAY) {
2585 		if (var_ast->attr == ZEND_ARRAY_SYNTAX_LONG) {
2586 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot assign to array(), use [] instead");
2587 		}
2588 		if (old_style != var_ast->attr) {
2589 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot mix [] and list()");
2590 		}
2591 	} else if (!zend_can_write_to_variable(var_ast)) {
2592 		zend_error_noreturn(E_COMPILE_ERROR, "Assignments can only happen to writable values");
2593 	}
2594 }
2595 /* }}} */
2596 
2597 static inline void zend_emit_assign_ref_znode(zend_ast *var_ast, znode *value_node);
2598 
2599 /* Propagate refs used on leaf elements to the surrounding list() structures. */
zend_propagate_list_refs(zend_ast *ast)2600 static zend_bool zend_propagate_list_refs(zend_ast *ast) { /* {{{ */
2601 	zend_ast_list *list = zend_ast_get_list(ast);
2602 	zend_bool has_refs = 0;
2603 	uint32_t i;
2604 
2605 	for (i = 0; i < list->children; ++i) {
2606 		zend_ast *elem_ast = list->child[i];
2607 
2608 		if (elem_ast) {
2609 			zend_ast *var_ast = elem_ast->child[0];
2610 			if (var_ast->kind == ZEND_AST_ARRAY) {
2611 				elem_ast->attr = zend_propagate_list_refs(var_ast);
2612 			}
2613 			has_refs |= elem_ast->attr;
2614 		}
2615 	}
2616 
2617 	return has_refs;
2618 }
2619 /* }}} */
2620 
zend_compile_list_assign( znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style)2621 static void zend_compile_list_assign(
2622 		znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style) /* {{{ */
2623 {
2624 	zend_ast_list *list = zend_ast_get_list(ast);
2625 	uint32_t i;
2626 	zend_bool has_elems = 0;
2627 	zend_bool is_keyed =
2628 		list->children > 0 && list->child[0] != NULL && list->child[0]->child[1] != NULL;
2629 
2630 	if (list->children && expr_node->op_type == IS_CONST && Z_TYPE(expr_node->u.constant) == IS_STRING) {
2631 		zval_make_interned_string(&expr_node->u.constant);
2632 	}
2633 
2634 	for (i = 0; i < list->children; ++i) {
2635 		zend_ast *elem_ast = list->child[i];
2636 		zend_ast *var_ast, *key_ast;
2637 		znode fetch_result, dim_node;
2638 		zend_op *opline;
2639 
2640 		if (elem_ast == NULL) {
2641 			if (is_keyed) {
2642 				zend_error(E_COMPILE_ERROR,
2643 					"Cannot use empty array entries in keyed array assignment");
2644 			} else {
2645 				continue;
2646 			}
2647 		}
2648 
2649 		if (elem_ast->kind == ZEND_AST_UNPACK) {
2650 			zend_error(E_COMPILE_ERROR,
2651 					"Spread operator is not supported in assignments");
2652 		}
2653 
2654 		var_ast = elem_ast->child[0];
2655 		key_ast = elem_ast->child[1];
2656 		has_elems = 1;
2657 
2658 		if (is_keyed) {
2659 			if (key_ast == NULL) {
2660 				zend_error(E_COMPILE_ERROR,
2661 					"Cannot mix keyed and unkeyed array entries in assignments");
2662 			}
2663 
2664 			zend_compile_expr(&dim_node, key_ast);
2665 		} else {
2666 			if (key_ast != NULL) {
2667 				zend_error(E_COMPILE_ERROR,
2668 					"Cannot mix keyed and unkeyed array entries in assignments");
2669 			}
2670 
2671 			dim_node.op_type = IS_CONST;
2672 			ZVAL_LONG(&dim_node.u.constant, i);
2673 		}
2674 
2675 		if (expr_node->op_type == IS_CONST) {
2676 			Z_TRY_ADDREF(expr_node->u.constant);
2677 		}
2678 
2679 		zend_verify_list_assign_target(var_ast, old_style);
2680 
2681 		opline = zend_emit_op(&fetch_result,
2682 			elem_ast->attr ? (expr_node->op_type == IS_CV ? ZEND_FETCH_DIM_W : ZEND_FETCH_LIST_W) : ZEND_FETCH_LIST_R, expr_node, &dim_node);
2683 
2684 		if (dim_node.op_type == IS_CONST) {
2685 			zend_handle_numeric_dim(opline, &dim_node);
2686 		}
2687 
2688 		if (var_ast->kind == ZEND_AST_ARRAY) {
2689 			if (elem_ast->attr) {
2690 				zend_emit_op(&fetch_result, ZEND_MAKE_REF, &fetch_result, NULL);
2691 			}
2692 			zend_compile_list_assign(NULL, var_ast, &fetch_result, var_ast->attr);
2693 		} else if (elem_ast->attr) {
2694 			zend_emit_assign_ref_znode(var_ast, &fetch_result);
2695 		} else {
2696 			zend_emit_assign_znode(var_ast, &fetch_result);
2697 		}
2698 	}
2699 
2700 	if (has_elems == 0) {
2701 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use empty list");
2702 	}
2703 
2704 	if (result) {
2705 		*result = *expr_node;
2706 	} else {
2707 		zend_do_free(expr_node);
2708 	}
2709 }
2710 /* }}} */
2711 
zend_ensure_writable_variable(const zend_ast *ast)2712 static void zend_ensure_writable_variable(const zend_ast *ast) /* {{{ */
2713 {
2714 	if (ast->kind == ZEND_AST_CALL) {
2715 		zend_error_noreturn(E_COMPILE_ERROR, "Can't use function return value in write context");
2716 	}
2717 	if (ast->kind == ZEND_AST_METHOD_CALL || ast->kind == ZEND_AST_STATIC_CALL) {
2718 		zend_error_noreturn(E_COMPILE_ERROR, "Can't use method return value in write context");
2719 	}
2720 }
2721 /* }}} */
2722 
2723 /* Detects $a... = $a pattern */
zend_is_assign_to_self(zend_ast *var_ast, zend_ast *expr_ast)2724 zend_bool zend_is_assign_to_self(zend_ast *var_ast, zend_ast *expr_ast) /* {{{ */
2725 {
2726 	if (expr_ast->kind != ZEND_AST_VAR || expr_ast->child[0]->kind != ZEND_AST_ZVAL) {
2727 		return 0;
2728 	}
2729 
2730 	while (zend_is_variable(var_ast) && var_ast->kind != ZEND_AST_VAR) {
2731 		var_ast = var_ast->child[0];
2732 	}
2733 
2734 	if (var_ast->kind != ZEND_AST_VAR || var_ast->child[0]->kind != ZEND_AST_ZVAL) {
2735 		return 0;
2736 	}
2737 
2738 	{
2739 		zend_string *name1 = zval_get_string(zend_ast_get_zval(var_ast->child[0]));
2740 		zend_string *name2 = zval_get_string(zend_ast_get_zval(expr_ast->child[0]));
2741 		zend_bool result = zend_string_equals(name1, name2);
2742 		zend_string_release_ex(name1, 0);
2743 		zend_string_release_ex(name2, 0);
2744 		return result;
2745 	}
2746 }
2747 /* }}} */
2748 
zend_compile_assign(znode *result, zend_ast *ast)2749 void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
2750 {
2751 	zend_ast *var_ast = ast->child[0];
2752 	zend_ast *expr_ast = ast->child[1];
2753 
2754 	znode var_node, expr_node;
2755 	zend_op *opline;
2756 	uint32_t offset;
2757 
2758 	if (is_this_fetch(var_ast)) {
2759 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
2760 	}
2761 
2762 	zend_ensure_writable_variable(var_ast);
2763 
2764 	switch (var_ast->kind) {
2765 		case ZEND_AST_VAR:
2766 			offset = zend_delayed_compile_begin();
2767 			zend_delayed_compile_var(&var_node, var_ast, BP_VAR_W, 0);
2768 			zend_compile_expr(&expr_node, expr_ast);
2769 			zend_delayed_compile_end(offset);
2770 			zend_emit_op(result, ZEND_ASSIGN, &var_node, &expr_node);
2771 			return;
2772 		case ZEND_AST_STATIC_PROP:
2773 			offset = zend_delayed_compile_begin();
2774 			zend_delayed_compile_var(result, var_ast, BP_VAR_W, 0);
2775 			zend_compile_expr(&expr_node, expr_ast);
2776 
2777 			opline = zend_delayed_compile_end(offset);
2778 			opline->opcode = ZEND_ASSIGN_STATIC_PROP;
2779 
2780 			zend_emit_op_data(&expr_node);
2781 			return;
2782 		case ZEND_AST_DIM:
2783 			offset = zend_delayed_compile_begin();
2784 			zend_delayed_compile_dim(result, var_ast, BP_VAR_W);
2785 
2786 			if (zend_is_assign_to_self(var_ast, expr_ast)
2787 			 && !is_this_fetch(expr_ast)) {
2788 				/* $a[0] = $a should evaluate the right $a first */
2789 				znode cv_node;
2790 
2791 				if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
2792 					zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
2793 				} else {
2794 					zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
2795 				}
2796 			} else {
2797 				zend_compile_expr(&expr_node, expr_ast);
2798 			}
2799 
2800 			opline = zend_delayed_compile_end(offset);
2801 			opline->opcode = ZEND_ASSIGN_DIM;
2802 
2803 			opline = zend_emit_op_data(&expr_node);
2804 			return;
2805 		case ZEND_AST_PROP:
2806 			offset = zend_delayed_compile_begin();
2807 			zend_delayed_compile_prop(result, var_ast, BP_VAR_W);
2808 			zend_compile_expr(&expr_node, expr_ast);
2809 
2810 			opline = zend_delayed_compile_end(offset);
2811 			opline->opcode = ZEND_ASSIGN_OBJ;
2812 
2813 			zend_emit_op_data(&expr_node);
2814 			return;
2815 		case ZEND_AST_ARRAY:
2816 			if (zend_propagate_list_refs(var_ast)) {
2817 				if (!zend_is_variable_or_call(expr_ast)) {
2818 					zend_error_noreturn(E_COMPILE_ERROR,
2819 						"Cannot assign reference to non referencable value");
2820 				}
2821 
2822 				zend_compile_var(&expr_node, expr_ast, BP_VAR_W, 1);
2823 				/* MAKE_REF is usually not necessary for CVs. However, if there are
2824 				 * self-assignments, this forces the RHS to evaluate first. */
2825 				zend_emit_op(&expr_node, ZEND_MAKE_REF, &expr_node, NULL);
2826 			} else {
2827 				if (expr_ast->kind == ZEND_AST_VAR) {
2828 					/* list($a, $b) = $a should evaluate the right $a first */
2829 					znode cv_node;
2830 
2831 					if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
2832 						zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
2833 					} else {
2834 						zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
2835 					}
2836 				} else {
2837 					zend_compile_expr(&expr_node, expr_ast);
2838 				}
2839 			}
2840 
2841 			zend_compile_list_assign(result, var_ast, &expr_node, var_ast->attr);
2842 			return;
2843 		EMPTY_SWITCH_DEFAULT_CASE();
2844 	}
2845 }
2846 /* }}} */
2847 
zend_compile_assign_ref(znode *result, zend_ast *ast)2848 void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
2849 {
2850 	zend_ast *target_ast = ast->child[0];
2851 	zend_ast *source_ast = ast->child[1];
2852 
2853 	znode target_node, source_node;
2854 	zend_op *opline;
2855 	uint32_t offset, flags;
2856 
2857 	if (is_this_fetch(target_ast)) {
2858 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
2859 	}
2860 	zend_ensure_writable_variable(target_ast);
2861 
2862 	offset = zend_delayed_compile_begin();
2863 	zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W, 1);
2864 	zend_compile_var(&source_node, source_ast, BP_VAR_W, 1);
2865 
2866 	if ((target_ast->kind != ZEND_AST_VAR
2867 	  || target_ast->child[0]->kind != ZEND_AST_ZVAL)
2868 	 && source_node.op_type != IS_CV) {
2869 		/* Both LHS and RHS expressions may modify the same data structure,
2870 		 * and the modification during RHS evaluation may dangle the pointer
2871 		 * to the result of the LHS evaluation.
2872 		 * Use MAKE_REF instruction to replace direct pointer with REFERENCE.
2873 		 * See: Bug #71539
2874 		 */
2875 		zend_emit_op(&source_node, ZEND_MAKE_REF, &source_node, NULL);
2876 	}
2877 
2878 	opline = zend_delayed_compile_end(offset);
2879 
2880 	if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) {
2881 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");
2882 	}
2883 
2884 	flags = zend_is_call(source_ast) ? ZEND_RETURNS_FUNCTION : 0;
2885 
2886 	if (opline && opline->opcode == ZEND_FETCH_OBJ_W) {
2887 		opline->opcode = ZEND_ASSIGN_OBJ_REF;
2888 		opline->extended_value &= ~ZEND_FETCH_REF;
2889 		opline->extended_value |=