Skip to content

Commit d553002

Browse files
author
Matt Wilmas
committed
MFH: Added zend_eval_stringl and made create_function(), etc. binary-safe
1 parent a80be68 commit d553002

File tree

8 files changed

+50
-18
lines changed

8 files changed

+50
-18
lines changed

‎Zend/zend_builtin_functions.c

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1673,18 +1673,37 @@ ZEND_FUNCTION(get_defined_vars)
16731673
ZEND_FUNCTION(create_function)
16741674
{
16751675
char *eval_code, *function_name, *function_args, *function_code;
1676-
int function_name_length, function_args_len, function_code_len;
1676+
int eval_code_length, function_name_length, function_args_len, function_code_len;
16771677
int retval;
16781678
char *eval_name;
16791679

16801680
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &function_args, &function_args_len, &function_code, &function_code_len) == FAILURE) {
16811681
return;
16821682
}
16831683

1684-
zend_spprintf(&eval_code, 0, "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}", function_args, function_code);
1684+
eval_code = (char *) emalloc(sizeof("function " LAMBDA_TEMP_FUNCNAME)
1685+
+function_args_len
1686+
+2 /* for the args parentheses */
1687+
+2 /* for the curly braces */
1688+
+function_code_len);
1689+
1690+
eval_code_length = sizeof("function " LAMBDA_TEMP_FUNCNAME "(") - 1;
1691+
memcpy(eval_code, "function " LAMBDA_TEMP_FUNCNAME "(", eval_code_length);
1692+
1693+
memcpy(eval_code + eval_code_length, function_args, function_args_len);
1694+
eval_code_length += function_args_len;
1695+
1696+
eval_code[eval_code_length++] = ')';
1697+
eval_code[eval_code_length++] = '{';
1698+
1699+
memcpy(eval_code + eval_code_length, function_code, function_code_len);
1700+
eval_code_length += function_code_len;
1701+
1702+
eval_code[eval_code_length++] = '}';
1703+
eval_code[eval_code_length] = '\0';
16851704

16861705
eval_name = zend_make_compiled_string_description("runtime-created function" TSRMLS_CC);
1687-
retval = zend_eval_string(eval_code, NULL, eval_name TSRMLS_CC);
1706+
retval = zend_eval_stringl(eval_code, eval_code_length, NULL, eval_name TSRMLS_CC);
16881707
efree(eval_code);
16891708
efree(eval_name);
16901709

@@ -1699,10 +1718,10 @@ ZEND_FUNCTION(create_function)
16991718
function_add_ref(&new_function);
17001719

17011720
function_name = (char *) emalloc(sizeof("0lambda_")+MAX_LENGTH_OF_LONG);
1721+
function_name[0] = '\0';
17021722

17031723
do {
1704-
sprintf(function_name, "%clambda_%d", 0, ++EG(lambda_count));
1705-
function_name_length = strlen(function_name+1)+1;
1724+
function_name_length = 1 + sprintf(function_name + 1, "lambda_%d", ++EG(lambda_count));
17061725
} while (zend_hash_add(EG(function_table), function_name, function_name_length+1, &new_function, sizeof(zend_function), NULL)==FAILURE);
17071726
zend_hash_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME));
17081727
RETURN_STRINGL(function_name, function_name_length, 0);

‎Zend/zend_execute.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,9 @@ static inline void safe_free_zval_ptr_rel(zval *p ZEND_FILE_LINE_DC ZEND_FILE_LI
7373
ZEND_API int zend_lookup_class(const char *name, int name_length, zend_class_entry ***ce TSRMLS_DC);
7474
ZEND_API int zend_lookup_class_ex(const char *name, int name_length, int use_autoload, zend_class_entry ***ce TSRMLS_DC);
7575
ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSRMLS_DC);
76+
ZEND_API int zend_eval_stringl(char *str, int str_len, zval *retval_ptr, char *string_name TSRMLS_DC);
7677
ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name, int handle_exceptions TSRMLS_DC);
78+
ZEND_API int zend_eval_stringl_ex(char *str, int str_len, zval *retval_ptr, char *string_name, int handle_exceptions TSRMLS_DC);
7779

7880
static inline int i_zend_is_true(zval *op)
7981
{

‎Zend/zend_execute_API.c

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1116,7 +1116,7 @@ ZEND_API int zend_lookup_class(const char *name, int name_length, zend_class_ent
11161116
}
11171117
/* }}} */
11181118

1119-
ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSRMLS_DC) /* {{{ */
1119+
ZEND_API int zend_eval_stringl(char *str, int str_len, zval *retval_ptr, char *string_name TSRMLS_DC) /* {{{ */
11201120
{
11211121
zval pv;
11221122
zend_op_array *new_op_array;
@@ -1125,15 +1125,14 @@ ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSR
11251125
int retval;
11261126

11271127
if (retval_ptr) {
1128-
int l = strlen(str);
1129-
Z_STRLEN(pv) = l + sizeof("return ;") - 1;
1128+
Z_STRLEN(pv) = str_len + sizeof("return ;") - 1;
11301129
Z_STRVAL(pv) = emalloc(Z_STRLEN(pv) + 1);
11311130
memcpy(Z_STRVAL(pv), "return ", sizeof("return ") - 1);
1132-
memcpy(Z_STRVAL(pv) + sizeof("return ") - 1, str, l);
1131+
memcpy(Z_STRVAL(pv) + sizeof("return ") - 1, str, str_len);
11331132
Z_STRVAL(pv)[Z_STRLEN(pv) - 1] = ';';
11341133
Z_STRVAL(pv)[Z_STRLEN(pv)] = '\0';
11351134
} else {
1136-
Z_STRLEN(pv) = strlen(str);
1135+
Z_STRLEN(pv) = str_len;
11371136
Z_STRVAL(pv) = str;
11381137
}
11391138
Z_TYPE(pv) = IS_STRING;
@@ -1188,11 +1187,17 @@ ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSR
11881187
}
11891188
/* }}} */
11901189

1191-
ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name, int handle_exceptions TSRMLS_DC) /* {{{ */
1190+
ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSRMLS_DC) /* {{{ */
1191+
{
1192+
return zend_eval_stringl(str, strlen(str), retval_ptr, string_name TSRMLS_CC);
1193+
}
1194+
/* }}} */
1195+
1196+
ZEND_API int zend_eval_stringl_ex(char *str, int str_len, zval *retval_ptr, char *string_name, int handle_exceptions TSRMLS_DC) /* {{{ */
11921197
{
11931198
int result;
11941199

1195-
result = zend_eval_string(str, retval_ptr, string_name TSRMLS_CC);
1200+
result = zend_eval_stringl(str, str_len, retval_ptr, string_name TSRMLS_CC);
11961201
if (handle_exceptions && EG(exception)) {
11971202
zend_exception_error(EG(exception), E_ERROR TSRMLS_CC);
11981203
result = FAILURE;
@@ -1201,6 +1206,12 @@ ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name,
12011206
}
12021207
/* }}} */
12031208

1209+
ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name, int handle_exceptions TSRMLS_DC) /* {{{ */
1210+
{
1211+
return zend_eval_stringl_ex(str, strlen(str), retval_ptr, string_name, handle_exceptions TSRMLS_CC);
1212+
}
1213+
/* }}} */
1214+
12041215
void execute_new_code(TSRMLS_D) /* {{{ */
12051216
{
12061217
zend_op *opline, *end;

‎ext/interbase/php_ibase_udf.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ void exec_php(BLOBCALLBACK b, PARAMDSC *res, ISC_SHORT *init)
165165
#endif
166166
/* feed it to the parser */
167167
zend_first_try {
168-
result = zend_eval_string(code, NULL, "Firebird Embedded PHP engine" TSRMLS_CC);
168+
result = zend_eval_stringl(code, b->blob_total_length, NULL, "Firebird Embedded PHP engine" TSRMLS_CC);
169169
} zend_end_try();
170170
}
171171

‎ext/mbstring/php_mbregex.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -914,9 +914,9 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
914914
if (eval) {
915915
zval v;
916916
/* null terminate buffer */
917-
smart_str_appendc(&eval_buf, '\0');
917+
smart_str_0(&eval_buf);
918918
/* do eval */
919-
if (zend_eval_string(eval_buf.c, &v, description TSRMLS_CC) == FAILURE) {
919+
if (zend_eval_stringl(eval_buf.c, eval_buf.len, &v, description TSRMLS_CC) == FAILURE) {
920920
efree(description);
921921
php_error_docref(NULL TSRMLS_CC,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, eval_buf.c);
922922
/* zend_error() does not return in this case */

‎ext/pcre/php_pcre.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -913,7 +913,7 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
913913

914914
compiled_string_description = zend_make_compiled_string_description("regexp code" TSRMLS_CC);
915915
/* Run the code */
916-
if (zend_eval_string(code.c, &retval, compiled_string_description TSRMLS_CC) == FAILURE) {
916+
if (zend_eval_stringl(code.c, code.len, &retval, compiled_string_description TSRMLS_CC) == FAILURE) {
917917
efree(compiled_string_description);
918918
php_error_docref(NULL TSRMLS_CC,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, code.c);
919919
/* zend_error() does not return in this case */

‎ext/standard/assert.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ PHP_FUNCTION(assert)
164164
}
165165

166166
compiled_string_description = zend_make_compiled_string_description("assert code" TSRMLS_CC);
167-
if (zend_eval_string(myeval, &retval, compiled_string_description TSRMLS_CC) == FAILURE) {
167+
if (zend_eval_stringl(myeval, Z_STRLEN_PP(assertion), &retval, compiled_string_description TSRMLS_CC) == FAILURE) {
168168
efree(compiled_string_description);
169169
php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Failure evaluating code: %s%s", PHP_EOL, myeval);
170170
if (ASSERTG(bail)) {

‎sapi/cli/php_cli.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1165,7 +1165,7 @@ int main(int argc, char *argv[])
11651165
continue;
11661166
}
11671167

1168-
zend_eval_string(code, NULL, "php shell code" TSRMLS_CC);
1168+
zend_eval_stringl(code, pos, NULL, "php shell code" TSRMLS_CC);
11691169
pos = 0;
11701170

11711171
if (php_last_char != '\0' && php_last_char != '\n') {

0 commit comments

Comments
 (0)