1 /*
2   +----------------------------------------------------------------------+
3   | Copyright (c) The PHP Group                                          |
4   +----------------------------------------------------------------------+
5   | This source file is subject to version 3.01 of the PHP license,      |
6   | that is bundled with this package in the file LICENSE, and is        |
7   | available through the world-wide-web at the following url:           |
8   | https://www.php.net/license/3_01.txt                                 |
9   | If you did not receive a copy of the PHP license and are unable to   |
10   | obtain it through the world-wide-web, please send a note to          |
11   | license@php.net so we can mail you a copy immediately.               |
12   +----------------------------------------------------------------------+
13   | Author: Wez Furlong <wez@thebrainroom.com>                           |
14   +----------------------------------------------------------------------+
15 */
16 
17 #ifdef HAVE_CONFIG_H
18 #include "config.h"
19 #endif
20 
21 #include "php.h"
22 #include "php_globals.h"
23 #include "ext/standard/info.h"
24 #include "php_sysvmsg.h"
25 #include "sysvmsg_arginfo.h"
26 #include "ext/standard/php_var.h"
27 #include "zend_smart_str.h"
28 
29 #include <sys/types.h>
30 #include <sys/ipc.h>
31 #include <sys/msg.h>
32 
33 PHP_MINIT_FUNCTION(sysvmsg);
34 PHP_MINFO_FUNCTION(sysvmsg);
35 
36 typedef struct {
37 	key_t key;
38 	zend_long id;
39 	zend_object std;
40 } sysvmsg_queue_t;
41 
42 struct php_msgbuf {
43 	zend_long mtype;
44 	char mtext[1];
45 };
46 
47 /* In order to detect MSG_EXCEPT use at run time; we have no way
48  * of knowing what the bit definitions are, so we can't just define
49  * out own MSG_EXCEPT value. */
50 #define PHP_MSG_IPC_NOWAIT	1
51 #define PHP_MSG_NOERROR		2
52 #define PHP_MSG_EXCEPT		4
53 
54 /* {{{ sysvmsg_module_entry */
55 zend_module_entry sysvmsg_module_entry = {
56 	STANDARD_MODULE_HEADER,
57 	"sysvmsg",
58 	ext_functions,
59 	PHP_MINIT(sysvmsg),
60 	NULL,
61 	NULL,
62 	NULL,
63 	PHP_MINFO(sysvmsg),
64 	PHP_SYSVMSG_VERSION,
65 	STANDARD_MODULE_PROPERTIES
66 };
67 /* }}} */
68 
69 #ifdef COMPILE_DL_SYSVMSG
70 ZEND_GET_MODULE(sysvmsg)
71 #endif
72 
73 /* SysvMessageQueue class */
74 
75 zend_class_entry *sysvmsg_queue_ce;
76 static zend_object_handlers sysvmsg_queue_object_handlers;
77 
sysvmsg_queue_from_obj(zend_object * obj)78 static inline sysvmsg_queue_t *sysvmsg_queue_from_obj(zend_object *obj) {
79 	return (sysvmsg_queue_t *)((char *)(obj) - XtOffsetOf(sysvmsg_queue_t, std));
80 }
81 
82 #define Z_SYSVMSG_QUEUE_P(zv) sysvmsg_queue_from_obj(Z_OBJ_P(zv))
83 
sysvmsg_queue_create_object(zend_class_entry * class_type)84 static zend_object *sysvmsg_queue_create_object(zend_class_entry *class_type) {
85 	sysvmsg_queue_t *intern = zend_object_alloc(sizeof(sysvmsg_queue_t), class_type);
86 
87 	zend_object_std_init(&intern->std, class_type);
88 	object_properties_init(&intern->std, class_type);
89 	intern->std.handlers = &sysvmsg_queue_object_handlers;
90 
91 	return &intern->std;
92 }
93 
sysvmsg_queue_get_constructor(zend_object * object)94 static zend_function *sysvmsg_queue_get_constructor(zend_object *object) {
95 	zend_throw_error(NULL, "Cannot directly construct SysvMessageQueue, use msg_get_queue() instead");
96 	return NULL;
97 }
98 
sysvmsg_queue_free_obj(zend_object * object)99 static void sysvmsg_queue_free_obj(zend_object *object)
100 {
101 	sysvmsg_queue_t *sysvmsg_queue = sysvmsg_queue_from_obj(object);
102 
103 	zend_object_std_dtor(&sysvmsg_queue->std);
104 }
105 /* }}} */
106 
107 /* {{{ PHP_MINIT_FUNCTION */
PHP_MINIT_FUNCTION(sysvmsg)108 PHP_MINIT_FUNCTION(sysvmsg)
109 {
110 	sysvmsg_queue_ce = register_class_SysvMessageQueue();
111 	sysvmsg_queue_ce->create_object = sysvmsg_queue_create_object;
112 
113 	memcpy(&sysvmsg_queue_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
114 	sysvmsg_queue_object_handlers.offset = XtOffsetOf(sysvmsg_queue_t, std);
115 	sysvmsg_queue_object_handlers.free_obj = sysvmsg_queue_free_obj;
116 	sysvmsg_queue_object_handlers.get_constructor = sysvmsg_queue_get_constructor;
117 	sysvmsg_queue_object_handlers.clone_obj = NULL;
118 	sysvmsg_queue_object_handlers.compare = zend_objects_not_comparable;
119 
120 	REGISTER_LONG_CONSTANT("MSG_IPC_NOWAIT", PHP_MSG_IPC_NOWAIT, CONST_PERSISTENT|CONST_CS);
121 	REGISTER_LONG_CONSTANT("MSG_EAGAIN",	 EAGAIN, 	     CONST_PERSISTENT|CONST_CS);
122 	REGISTER_LONG_CONSTANT("MSG_ENOMSG",	 ENOMSG, 	     CONST_PERSISTENT|CONST_CS);
123 	REGISTER_LONG_CONSTANT("MSG_NOERROR",    PHP_MSG_NOERROR,    CONST_PERSISTENT|CONST_CS);
124 	REGISTER_LONG_CONSTANT("MSG_EXCEPT",     PHP_MSG_EXCEPT,     CONST_PERSISTENT|CONST_CS);
125 	return SUCCESS;
126 }
127 /* }}} */
128 
129 /* {{{ PHP_MINFO_FUNCTION */
PHP_MINFO_FUNCTION(sysvmsg)130 PHP_MINFO_FUNCTION(sysvmsg)
131 {
132 	php_info_print_table_start();
133 	php_info_print_table_row(2, "sysvmsg support", "enabled");
134 	php_info_print_table_end();
135 }
136 /* }}} */
137 
138 /* {{{ Set information for a message queue */
PHP_FUNCTION(msg_set_queue)139 PHP_FUNCTION(msg_set_queue)
140 {
141 	zval *queue, *data;
142 	sysvmsg_queue_t *mq = NULL;
143 	struct msqid_ds stat;
144 
145 	RETVAL_FALSE;
146 
147 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oa", &queue, sysvmsg_queue_ce, &data) == FAILURE) {
148 		RETURN_THROWS();
149 	}
150 
151 	mq = Z_SYSVMSG_QUEUE_P(queue);
152 
153 	if (msgctl(mq->id, IPC_STAT, &stat) == 0) {
154 		zval *item;
155 
156 		/* now pull out members of data and set them in the stat buffer */
157 		if ((item = zend_hash_str_find(Z_ARRVAL_P(data), "msg_perm.uid", sizeof("msg_perm.uid") - 1)) != NULL) {
158 			stat.msg_perm.uid = zval_get_long(item);
159 		}
160 		if ((item = zend_hash_str_find(Z_ARRVAL_P(data), "msg_perm.gid", sizeof("msg_perm.gid") - 1)) != NULL) {
161 			stat.msg_perm.gid = zval_get_long(item);
162 		}
163 		if ((item = zend_hash_str_find(Z_ARRVAL_P(data), "msg_perm.mode", sizeof("msg_perm.mode") - 1)) != NULL) {
164 			stat.msg_perm.mode = zval_get_long(item);
165 		}
166 		if ((item = zend_hash_str_find(Z_ARRVAL_P(data), "msg_qbytes", sizeof("msg_qbytes") - 1)) != NULL) {
167 			stat.msg_qbytes = zval_get_long(item);
168 		}
169 		if (msgctl(mq->id, IPC_SET, &stat) == 0) {
170 			RETVAL_TRUE;
171 		}
172 	}
173 }
174 /* }}} */
175 
176 /* {{{ Returns information about a message queue */
PHP_FUNCTION(msg_stat_queue)177 PHP_FUNCTION(msg_stat_queue)
178 {
179 	zval *queue;
180 	sysvmsg_queue_t *mq = NULL;
181 	struct msqid_ds stat;
182 
183 	RETVAL_FALSE;
184 
185 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "O", &queue, sysvmsg_queue_ce) == FAILURE) {
186 		RETURN_THROWS();
187 	}
188 
189 	mq = Z_SYSVMSG_QUEUE_P(queue);
190 
191 	if (msgctl(mq->id, IPC_STAT, &stat) == 0) {
192 		array_init(return_value);
193 
194 		add_assoc_long(return_value, "msg_perm.uid", stat.msg_perm.uid);
195 		add_assoc_long(return_value, "msg_perm.gid", stat.msg_perm.gid);
196 		add_assoc_long(return_value, "msg_perm.mode", stat.msg_perm.mode);
197 		add_assoc_long(return_value, "msg_stime",  stat.msg_stime);
198 		add_assoc_long(return_value, "msg_rtime",  stat.msg_rtime);
199 		add_assoc_long(return_value, "msg_ctime",  stat.msg_ctime);
200 		add_assoc_long(return_value, "msg_qnum",   stat.msg_qnum);
201 		add_assoc_long(return_value, "msg_qbytes", stat.msg_qbytes);
202 		add_assoc_long(return_value, "msg_lspid",  stat.msg_lspid);
203 		add_assoc_long(return_value, "msg_lrpid",  stat.msg_lrpid);
204 	}
205 }
206 /* }}} */
207 
208 /* {{{ Check whether a message queue exists */
PHP_FUNCTION(msg_queue_exists)209 PHP_FUNCTION(msg_queue_exists)
210 {
211 	zend_long key;
212 
213 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &key) == FAILURE)	{
214 		RETURN_THROWS();
215 	}
216 
217 	if (msgget(key, 0) < 0) {
218 		RETURN_FALSE;
219 	}
220 
221 	RETURN_TRUE;
222 }
223 /* }}} */
224 
225 /* {{{ Attach to a message queue */
PHP_FUNCTION(msg_get_queue)226 PHP_FUNCTION(msg_get_queue)
227 {
228 	zend_long key;
229 	zend_long perms = 0666;
230 	sysvmsg_queue_t *mq;
231 
232 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|l", &key, &perms) == FAILURE)	{
233 		RETURN_THROWS();
234 	}
235 
236 	object_init_ex(return_value, sysvmsg_queue_ce);
237 	mq = Z_SYSVMSG_QUEUE_P(return_value);
238 
239 	mq->key = key;
240 	mq->id = msgget(key, 0);
241 	if (mq->id < 0)	{
242 		/* doesn't already exist; create it */
243 		mq->id = msgget(key, IPC_CREAT | IPC_EXCL | perms);
244 		if (mq->id < 0)	{
245 			php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
246 			zval_ptr_dtor(return_value);
247 			RETURN_FALSE;
248 		}
249 	}
250 }
251 /* }}} */
252 
253 /* {{{ Destroy the queue */
PHP_FUNCTION(msg_remove_queue)254 PHP_FUNCTION(msg_remove_queue)
255 {
256 	zval *queue;
257 	sysvmsg_queue_t *mq = NULL;
258 
259 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "O", &queue, sysvmsg_queue_ce) == FAILURE) {
260 		RETURN_THROWS();
261 	}
262 
263 	mq = Z_SYSVMSG_QUEUE_P(queue);
264 
265 	if (msgctl(mq->id, IPC_RMID, NULL) == 0) {
266 		RETVAL_TRUE;
267 	} else {
268 		RETVAL_FALSE;
269 	}
270 }
271 /* }}} */
272 
273 /* {{{ Send a message of type msgtype (must be > 0) to a message queue */
PHP_FUNCTION(msg_receive)274 PHP_FUNCTION(msg_receive)
275 {
276 	zval *out_message, *queue, *out_msgtype, *zerrcode = NULL;
277 	zend_long desiredmsgtype, maxsize, flags = 0;
278 	zend_long realflags = 0;
279 	bool do_unserialize = 1;
280 	sysvmsg_queue_t *mq = NULL;
281 	struct php_msgbuf *messagebuffer = NULL; /* buffer to transmit */
282 	int result;
283 
284 	RETVAL_FALSE;
285 
286 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Olzlz|blz",
287 				&queue, sysvmsg_queue_ce, &desiredmsgtype, &out_msgtype, &maxsize,
288 				&out_message, &do_unserialize, &flags, &zerrcode) == FAILURE) {
289 		RETURN_THROWS();
290 	}
291 
292 	if (maxsize <= 0) {
293 		zend_argument_value_error(4, "must be greater than 0");
294 		RETURN_THROWS();
295 	}
296 
297 	if (flags != 0) {
298 		if (flags & PHP_MSG_EXCEPT) {
299 #ifndef MSG_EXCEPT
300 			php_error_docref(NULL, E_WARNING, "MSG_EXCEPT is not supported on your system");
301 			RETURN_FALSE;
302 #else
303 			realflags |= MSG_EXCEPT;
304 #endif
305 		}
306 		if (flags & PHP_MSG_NOERROR) {
307 			realflags |= MSG_NOERROR;
308 		}
309 		if (flags & PHP_MSG_IPC_NOWAIT) {
310 			realflags |= IPC_NOWAIT;
311 		}
312 	}
313 
314 	mq = Z_SYSVMSG_QUEUE_P(queue);
315 
316 	messagebuffer = (struct php_msgbuf *) safe_emalloc(maxsize, 1, sizeof(struct php_msgbuf));
317 
318 	result = msgrcv(mq->id, messagebuffer, maxsize, desiredmsgtype, realflags);
319 
320 	if (result >= 0) {
321 		/* got it! */
322 		ZEND_TRY_ASSIGN_REF_LONG(out_msgtype, messagebuffer->mtype);
323 		if (zerrcode) {
324 			ZEND_TRY_ASSIGN_REF_LONG(zerrcode, 0);
325 		}
326 
327 		RETVAL_TRUE;
328 		if (do_unserialize)	{
329 			php_unserialize_data_t var_hash;
330 			zval tmp;
331 			const unsigned char *p = (const unsigned char *) messagebuffer->mtext;
332 
333 			PHP_VAR_UNSERIALIZE_INIT(var_hash);
334 			if (!php_var_unserialize(&tmp, &p, p + result, &var_hash)) {
335 				php_error_docref(NULL, E_WARNING, "Message corrupted");
336 				ZEND_TRY_ASSIGN_REF_FALSE(out_message);
337 				RETVAL_FALSE;
338 			} else {
339 				ZEND_TRY_ASSIGN_REF_TMP(out_message, &tmp);
340 			}
341 			PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
342 		} else {
343 			ZEND_TRY_ASSIGN_REF_STRINGL(out_message, messagebuffer->mtext, result);
344 		}
345 	} else {
346 		ZEND_TRY_ASSIGN_REF_LONG(out_msgtype, 0);
347 		ZEND_TRY_ASSIGN_REF_FALSE(out_message);
348 		if (zerrcode) {
349 			ZEND_TRY_ASSIGN_REF_LONG(zerrcode, errno);
350 		}
351 	}
352 	efree(messagebuffer);
353 }
354 /* }}} */
355 
356 /* {{{ Send a message of type msgtype (must be > 0) to a message queue */
PHP_FUNCTION(msg_send)357 PHP_FUNCTION(msg_send)
358 {
359 	zval *message, *queue, *zerror=NULL;
360 	zend_long msgtype;
361 	bool do_serialize = 1, blocking = 1;
362 	sysvmsg_queue_t * mq = NULL;
363 	struct php_msgbuf * messagebuffer = NULL; /* buffer to transmit */
364 	int result;
365 	size_t message_len = 0;
366 
367 	RETVAL_FALSE;
368 
369 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Olz|bbz",
370 				&queue, sysvmsg_queue_ce, &msgtype, &message, &do_serialize, &blocking, &zerror) == FAILURE) {
371 		RETURN_THROWS();
372 	}
373 
374 	mq = Z_SYSVMSG_QUEUE_P(queue);
375 
376 	if (do_serialize) {
377 		smart_str msg_var = {0};
378 		php_serialize_data_t var_hash;
379 
380 		PHP_VAR_SERIALIZE_INIT(var_hash);
381 		php_var_serialize(&msg_var, message, &var_hash);
382 		PHP_VAR_SERIALIZE_DESTROY(var_hash);
383 
384 		/* NB: php_msgbuf is 1 char bigger than a long, so there is no need to
385 		 * allocate the extra byte. */
386 		messagebuffer = safe_emalloc(ZSTR_LEN(msg_var.s), 1, sizeof(struct php_msgbuf));
387 		memcpy(messagebuffer->mtext, ZSTR_VAL(msg_var.s), ZSTR_LEN(msg_var.s) + 1);
388 		message_len = ZSTR_LEN(msg_var.s);
389 		smart_str_free(&msg_var);
390 	} else {
391 		char *p;
392 		switch (Z_TYPE_P(message)) {
393 			case IS_STRING:
394 				p = Z_STRVAL_P(message);
395 				message_len = Z_STRLEN_P(message);
396 				break;
397 			case IS_LONG:
398 				message_len = spprintf(&p, 0, ZEND_LONG_FMT, Z_LVAL_P(message));
399 				break;
400 			case IS_FALSE:
401 				message_len = spprintf(&p, 0, "0");
402 				break;
403 			case IS_TRUE:
404 				message_len = spprintf(&p, 0, "1");
405 				break;
406 			case IS_DOUBLE:
407 				message_len = spprintf(&p, 0, "%F", Z_DVAL_P(message));
408 				break;
409 
410 			default:
411 				zend_argument_type_error(3, "must be of type string|int|float|bool, %s given", zend_zval_type_name(message));
412 				RETURN_THROWS();
413 		}
414 
415 		messagebuffer = safe_emalloc(message_len, 1, sizeof(struct php_msgbuf));
416 		memcpy(messagebuffer->mtext, p, message_len + 1);
417 
418 		if (Z_TYPE_P(message) != IS_STRING) {
419 			efree(p);
420 		}
421 	}
422 
423 	/* set the message type */
424 	messagebuffer->mtype = msgtype;
425 
426 	result = msgsnd(mq->id, messagebuffer, message_len, blocking ? 0 : IPC_NOWAIT);
427 
428 	efree(messagebuffer);
429 
430 	if (result == -1) {
431 		php_error_docref(NULL, E_WARNING, "msgsnd failed: %s", strerror(errno));
432 		if (zerror) {
433 			ZEND_TRY_ASSIGN_REF_LONG(zerror, errno);
434 		}
435 	} else {
436 		RETVAL_TRUE;
437 	}
438 }
439 /* }}} */
440