1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Dmitry Stogov <dmitry@php.net>                              |
18    +----------------------------------------------------------------------+
19 */
20 
21 #ifndef ZEND_OPERATORS_H
22 #define ZEND_OPERATORS_H
23 
24 #include <errno.h>
25 #include <math.h>
26 #include <assert.h>
27 #include <stddef.h>
28 
29 #ifdef HAVE_IEEEFP_H
30 #include <ieeefp.h>
31 #endif
32 
33 #include "zend_portability.h"
34 #include "zend_strtod.h"
35 #include "zend_multiply.h"
36 #include "zend_object_handlers.h"
37 
38 #define LONG_SIGN_MASK ZEND_LONG_MIN
39 
40 BEGIN_EXTERN_C()
41 ZEND_API zend_result ZEND_FASTCALL add_function(zval *result, zval *op1, zval *op2);
42 ZEND_API zend_result ZEND_FASTCALL sub_function(zval *result, zval *op1, zval *op2);
43 ZEND_API zend_result ZEND_FASTCALL mul_function(zval *result, zval *op1, zval *op2);
44 ZEND_API zend_result ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2);
45 ZEND_API zend_result ZEND_FASTCALL div_function(zval *result, zval *op1, zval *op2);
46 ZEND_API zend_result ZEND_FASTCALL mod_function(zval *result, zval *op1, zval *op2);
47 ZEND_API zend_result ZEND_FASTCALL boolean_xor_function(zval *result, zval *op1, zval *op2);
48 ZEND_API zend_result ZEND_FASTCALL boolean_not_function(zval *result, zval *op1);
49 ZEND_API zend_result ZEND_FASTCALL bitwise_not_function(zval *result, zval *op1);
50 ZEND_API zend_result ZEND_FASTCALL bitwise_or_function(zval *result, zval *op1, zval *op2);
51 ZEND_API zend_result ZEND_FASTCALL bitwise_and_function(zval *result, zval *op1, zval *op2);
52 ZEND_API zend_result ZEND_FASTCALL bitwise_xor_function(zval *result, zval *op1, zval *op2);
53 ZEND_API zend_result ZEND_FASTCALL shift_left_function(zval *result, zval *op1, zval *op2);
54 ZEND_API zend_result ZEND_FASTCALL shift_right_function(zval *result, zval *op1, zval *op2);
55 ZEND_API zend_result ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2);
56 
57 ZEND_API bool ZEND_FASTCALL zend_is_identical(zval *op1, zval *op2);
58 
59 ZEND_API zend_result ZEND_FASTCALL is_equal_function(zval *result, zval *op1, zval *op2);
60 ZEND_API zend_result ZEND_FASTCALL is_identical_function(zval *result, zval *op1, zval *op2);
61 ZEND_API zend_result ZEND_FASTCALL is_not_identical_function(zval *result, zval *op1, zval *op2);
62 ZEND_API zend_result ZEND_FASTCALL is_not_equal_function(zval *result, zval *op1, zval *op2);
63 ZEND_API zend_result ZEND_FASTCALL is_smaller_function(zval *result, zval *op1, zval *op2);
64 ZEND_API zend_result ZEND_FASTCALL is_smaller_or_equal_function(zval *result, zval *op1, zval *op2);
65 
66 ZEND_API bool ZEND_FASTCALL zend_class_implements_interface(const zend_class_entry *class_ce, const zend_class_entry *interface_ce);
67 ZEND_API bool ZEND_FASTCALL instanceof_function_slow(const zend_class_entry *instance_ce, const zend_class_entry *ce);
68 
instanceof_function(const zend_class_entry * instance_ce,const zend_class_entry * ce)69 static zend_always_inline bool instanceof_function(
70 		const zend_class_entry *instance_ce, const zend_class_entry *ce) {
71 	return instance_ce == ce || instanceof_function_slow(instance_ce, ce);
72 }
73 
74 /**
75  * Checks whether the string "str" with length "length" is numeric. The value
76  * of allow_errors determines whether it's required to be entirely numeric, or
77  * just its prefix. Leading whitespace is allowed.
78  *
79  * The function returns 0 if the string did not contain a valid number; IS_LONG
80  * if it contained a number that fits within the range of a long; or IS_DOUBLE
81  * if the number was out of long range or contained a decimal point/exponent.
82  * The number's value is returned into the respective pointer, *lval or *dval,
83  * if that pointer is not NULL.
84  *
85  * This variant also gives information if a string that represents an integer
86  * could not be represented as such due to overflow. It writes 1 to oflow_info
87  * if the integer is larger than ZEND_LONG_MAX and -1 if it's smaller than ZEND_LONG_MIN.
88  */
89 ZEND_API zend_uchar ZEND_FASTCALL _is_numeric_string_ex(const char *str, size_t length, zend_long *lval,
90 	double *dval, bool allow_errors, int *oflow_info, bool *trailing_data);
91 
92 ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);
93 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);
94 
95 #if SIZEOF_ZEND_LONG == 4
96 #	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
97 #else
98 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
99 #	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
100 #endif
101 
102 #ifdef ZEND_DVAL_TO_LVAL_CAST_OK
zend_dval_to_lval(double d)103 static zend_always_inline zend_long zend_dval_to_lval(double d)
104 {
105     if (EXPECTED(zend_finite(d)) && EXPECTED(!zend_isnan(d))) {
106         return (zend_long)d;
107     } else {
108         return 0;
109     }
110 }
111 #else
112 ZEND_API zend_long ZEND_FASTCALL zend_dval_to_lval_slow(double d);
113 
zend_dval_to_lval(double d)114 static zend_always_inline zend_long zend_dval_to_lval(double d)
115 {
116 	if (UNEXPECTED(!zend_finite(d)) || UNEXPECTED(zend_isnan(d))) {
117 		return 0;
118 	} else if (!ZEND_DOUBLE_FITS_LONG(d)) {
119 		return zend_dval_to_lval_slow(d);
120 	}
121 	return (zend_long)d;
122 }
123 #endif
124 
125 /* Used to convert a string float to integer during an (int) cast */
zend_dval_to_lval_cap(double d)126 static zend_always_inline zend_long zend_dval_to_lval_cap(double d)
127 {
128 	if (UNEXPECTED(!zend_finite(d)) || UNEXPECTED(zend_isnan(d))) {
129 		return 0;
130 	} else if (!ZEND_DOUBLE_FITS_LONG(d)) {
131 		return (d > 0 ? ZEND_LONG_MAX : ZEND_LONG_MIN);
132 	}
133 	return (zend_long)d;
134 }
135 /* }}} */
136 
zend_is_long_compatible(double d,zend_long l)137 static zend_always_inline bool zend_is_long_compatible(double d, zend_long l) {
138 	return (double)l == d;
139 }
140 
141 ZEND_API void zend_incompatible_double_to_long_error(double d);
142 ZEND_API void zend_incompatible_string_to_long_error(const zend_string *s);
143 
zend_dval_to_lval_safe(double d)144 static zend_always_inline zend_long zend_dval_to_lval_safe(double d)
145 {
146 	zend_long l = zend_dval_to_lval(d);
147 	if (!zend_is_long_compatible(d, l)) {
148 		zend_incompatible_double_to_long_error(d);
149 	}
150 	return l;
151 }
152 
153 #define ZEND_IS_DIGIT(c) ((c) >= '0' && (c) <= '9')
154 #define ZEND_IS_XDIGIT(c) (((c) >= 'A' && (c) <= 'F') || ((c) >= 'a' && (c) <= 'f'))
155 
is_numeric_string_ex(const char * str,size_t length,zend_long * lval,double * dval,bool allow_errors,int * oflow_info,bool * trailing_data)156 static zend_always_inline zend_uchar is_numeric_string_ex(const char *str, size_t length, zend_long *lval,
157 	double *dval, bool allow_errors, int *oflow_info, bool *trailing_data)
158 {
159 	if (*str > '9') {
160 		return 0;
161 	}
162 	return _is_numeric_string_ex(str, length, lval, dval, allow_errors, oflow_info, trailing_data);
163 }
164 
is_numeric_string(const char * str,size_t length,zend_long * lval,double * dval,bool allow_errors)165 static zend_always_inline zend_uchar is_numeric_string(const char *str, size_t length, zend_long *lval, double *dval, bool allow_errors) {
166     return is_numeric_string_ex(str, length, lval, dval, allow_errors, NULL, NULL);
167 }
168 
169 ZEND_API zend_uchar ZEND_FASTCALL is_numeric_str_function(const zend_string *str, zend_long *lval, double *dval);
170 
171 static zend_always_inline const char *
zend_memnstr(const char * haystack,const char * needle,size_t needle_len,const char * end)172 zend_memnstr(const char *haystack, const char *needle, size_t needle_len, const char *end)
173 {
174 	const char *p = haystack;
175 	ptrdiff_t off_p;
176 	size_t off_s;
177 
178 	if (needle_len == 0) {
179 		return p;
180 	}
181 
182 	if (needle_len == 1) {
183 		return (const char *)memchr(p, *needle, (end-p));
184 	}
185 
186 	off_p = end - haystack;
187 	off_s = (off_p > 0) ? (size_t)off_p : 0;
188 
189 	if (needle_len > off_s) {
190 		return NULL;
191 	}
192 
193 	if (EXPECTED(off_s < 1024 || needle_len < 9)) {	/* glibc memchr is faster when needle is too short */
194 		const char ne = needle[needle_len-1];
195 		end -= needle_len;
196 
197 		while (p <= end) {
198 			if ((p = (const char *)memchr(p, *needle, (end-p+1))) && ne == p[needle_len-1]) {
199 				if (!memcmp(needle+1, p+1, needle_len-2)) {
200 					return p;
201 				}
202 			}
203 
204 			if (p == NULL) {
205 				return NULL;
206 			}
207 
208 			p++;
209 		}
210 
211 		return NULL;
212 	} else {
213 		return zend_memnstr_ex(haystack, needle, needle_len, end);
214 	}
215 }
216 
zend_memrchr(const void * s,int c,size_t n)217 static zend_always_inline const void *zend_memrchr(const void *s, int c, size_t n)
218 {
219 	const unsigned char *e;
220 	if (0 == n) {
221 		return NULL;
222 	}
223 
224 	for (e = (const unsigned char *)s + n - 1; e >= (const unsigned char *)s; e--) {
225 		if (*e == (unsigned char)c) {
226 			return (const void *)e;
227 		}
228 	}
229 	return NULL;
230 }
231 
232 
233 static zend_always_inline const char *
zend_memnrstr(const char * haystack,const char * needle,size_t needle_len,const char * end)234 zend_memnrstr(const char *haystack, const char *needle, size_t needle_len, const char *end)
235 {
236     const char *p = end;
237     ptrdiff_t off_p;
238     size_t off_s;
239 
240 	if (needle_len == 0) {
241 		return p;
242 	}
243 
244     if (needle_len == 1) {
245         return (const char *)zend_memrchr(haystack, *needle, (p - haystack));
246     }
247 
248     off_p = end - haystack;
249     off_s = (off_p > 0) ? (size_t)off_p : 0;
250 
251     if (needle_len > off_s) {
252         return NULL;
253     }
254 
255 	if (EXPECTED(off_s < 1024 || needle_len < 3)) {
256 		const char ne = needle[needle_len-1];
257 		p -= needle_len;
258 
259 		do {
260 			p = (const char *)zend_memrchr(haystack, *needle, (p - haystack) + 1);
261 			if (!p) {
262 				return NULL;
263 			}
264 			if (ne == p[needle_len-1] && !memcmp(needle + 1, p + 1, needle_len - 2)) {
265 				return p;
266 			}
267 		} while (p-- >= haystack);
268 
269 		return NULL;
270 	} else {
271 		return zend_memnrstr_ex(haystack, needle, needle_len, end);
272 	}
273 }
274 
275 ZEND_API zend_result ZEND_FASTCALL increment_function(zval *op1);
276 ZEND_API zend_result ZEND_FASTCALL decrement_function(zval *op2);
277 
278 ZEND_API void ZEND_FASTCALL convert_scalar_to_number(zval *op);
279 ZEND_API void ZEND_FASTCALL _convert_to_string(zval *op);
280 ZEND_API void ZEND_FASTCALL convert_to_long(zval *op);
281 ZEND_API void ZEND_FASTCALL convert_to_double(zval *op);
282 ZEND_API void ZEND_FASTCALL convert_to_null(zval *op);
283 ZEND_API void ZEND_FASTCALL convert_to_boolean(zval *op);
284 ZEND_API void ZEND_FASTCALL convert_to_array(zval *op);
285 ZEND_API void ZEND_FASTCALL convert_to_object(zval *op);
286 
287 ZEND_API zend_long    ZEND_FASTCALL zval_get_long_func(zval *op, bool is_strict);
288 ZEND_API double       ZEND_FASTCALL zval_get_double_func(zval *op);
289 ZEND_API zend_string* ZEND_FASTCALL zval_get_string_func(zval *op);
290 ZEND_API zend_string* ZEND_FASTCALL zval_try_get_string_func(zval *op);
291 
zval_get_long(zval * op)292 static zend_always_inline zend_long zval_get_long(zval *op) {
293 	return EXPECTED(Z_TYPE_P(op) == IS_LONG) ? Z_LVAL_P(op) : zval_get_long_func(op, false);
294 }
zval_get_long_ex(zval * op,bool is_strict)295 static zend_always_inline zend_long zval_get_long_ex(zval *op, bool is_strict) {
296 	return EXPECTED(Z_TYPE_P(op) == IS_LONG) ? Z_LVAL_P(op) : zval_get_long_func(op, is_strict);
297 }
zval_get_double(zval * op)298 static zend_always_inline double zval_get_double(zval *op) {
299 	return EXPECTED(Z_TYPE_P(op) == IS_DOUBLE) ? Z_DVAL_P(op) : zval_get_double_func(op);
300 }
zval_get_string(zval * op)301 static zend_always_inline zend_string *zval_get_string(zval *op) {
302 	return EXPECTED(Z_TYPE_P(op) == IS_STRING) ? zend_string_copy(Z_STR_P(op)) : zval_get_string_func(op);
303 }
304 
zval_get_tmp_string(zval * op,zend_string ** tmp)305 static zend_always_inline zend_string *zval_get_tmp_string(zval *op, zend_string **tmp) {
306 	if (EXPECTED(Z_TYPE_P(op) == IS_STRING)) {
307 		*tmp = NULL;
308 		return Z_STR_P(op);
309 	} else {
310 		return *tmp = zval_get_string_func(op);
311 	}
312 }
zend_tmp_string_release(zend_string * tmp)313 static zend_always_inline void zend_tmp_string_release(zend_string *tmp) {
314 	if (UNEXPECTED(tmp)) {
315 		zend_string_release_ex(tmp, 0);
316 	}
317 }
318 
319 /* Like zval_get_string, but returns NULL if the conversion fails with an exception. */
zval_try_get_string(zval * op)320 static zend_always_inline zend_string *zval_try_get_string(zval *op) {
321 	if (EXPECTED(Z_TYPE_P(op) == IS_STRING)) {
322 		zend_string *ret = zend_string_copy(Z_STR_P(op));
323 		ZEND_ASSUME(ret != NULL);
324 		return ret;
325 	} else {
326 		return zval_try_get_string_func(op);
327 	}
328 }
329 
330 /* Like zval_get_tmp_string, but returns NULL if the conversion fails with an exception. */
zval_try_get_tmp_string(zval * op,zend_string ** tmp)331 static zend_always_inline zend_string *zval_try_get_tmp_string(zval *op, zend_string **tmp) {
332 	if (EXPECTED(Z_TYPE_P(op) == IS_STRING)) {
333 		zend_string *ret = Z_STR_P(op);
334 		*tmp = NULL;
335 		ZEND_ASSUME(ret != NULL);
336 		return ret;
337 	} else {
338 		return *tmp = zval_try_get_string_func(op);
339 	}
340 }
341 
342 /* Like convert_to_string(), but returns whether the conversion succeeded and does not modify the
343  * zval in-place if it fails. */
344 ZEND_API bool ZEND_FASTCALL _try_convert_to_string(zval *op);
try_convert_to_string(zval * op)345 static zend_always_inline bool try_convert_to_string(zval *op) {
346 	if (Z_TYPE_P(op) == IS_STRING) {
347 		return 1;
348 	}
349 	return _try_convert_to_string(op);
350 }
351 
352 /* Compatibility macros for 7.2 and below */
353 #define _zval_get_long(op) zval_get_long(op)
354 #define _zval_get_double(op) zval_get_double(op)
355 #define _zval_get_string(op) zval_get_string(op)
356 #define _zval_get_long_func(op) zval_get_long_func(op)
357 #define _zval_get_double_func(op) zval_get_double_func(op)
358 #define _zval_get_string_func(op) zval_get_string_func(op)
359 
360 #define convert_to_string(op) if (Z_TYPE_P(op) != IS_STRING) { _convert_to_string((op)); }
361 
362 
363 ZEND_API int ZEND_FASTCALL zend_is_true(zval *op);
364 ZEND_API bool ZEND_FASTCALL zend_object_is_true(zval *op);
365 
366 #define zval_is_true(op) \
367 	zend_is_true(op)
368 
i_zend_is_true(zval * op)369 static zend_always_inline bool i_zend_is_true(zval *op)
370 {
371 	bool result = 0;
372 
373 again:
374 	switch (Z_TYPE_P(op)) {
375 		case IS_TRUE:
376 			result = 1;
377 			break;
378 		case IS_LONG:
379 			if (Z_LVAL_P(op)) {
380 				result = 1;
381 			}
382 			break;
383 		case IS_DOUBLE:
384 			if (Z_DVAL_P(op)) {
385 				result = 1;
386 			}
387 			break;
388 		case IS_STRING:
389 			if (Z_STRLEN_P(op) > 1 || (Z_STRLEN_P(op) && Z_STRVAL_P(op)[0] != '0')) {
390 				result = 1;
391 			}
392 			break;
393 		case IS_ARRAY:
394 			if (zend_hash_num_elements(Z_ARRVAL_P(op))) {
395 				result = 1;
396 			}
397 			break;
398 		case IS_OBJECT:
399 			if (EXPECTED(Z_OBJ_HT_P(op)->cast_object == zend_std_cast_object_tostring)) {
400 				result = 1;
401 			} else {
402 				result = zend_object_is_true(op);
403 			}
404 			break;
405 		case IS_RESOURCE:
406 			if (EXPECTED(Z_RES_HANDLE_P(op))) {
407 				result = 1;
408 			}
409 			break;
410 		case IS_REFERENCE:
411 			op = Z_REFVAL_P(op);
412 			goto again;
413 			break;
414 		default:
415 			break;
416 	}
417 	return result;
418 }
419 
420 /* Indicate that two values cannot be compared. This value should be returned for both orderings
421  * of the operands. This implies that all of ==, <, <= and >, >= will return false, because we
422  * canonicalize >/>= to </<= with swapped operands. */
423 // TODO: Use a different value to allow an actual distinction here.
424 #define ZEND_UNCOMPARABLE 1
425 
426 ZEND_API int ZEND_FASTCALL zend_compare(zval *op1, zval *op2);
427 
428 ZEND_API zend_result ZEND_FASTCALL compare_function(zval *result, zval *op1, zval *op2);
429 
430 ZEND_API int ZEND_FASTCALL numeric_compare_function(zval *op1, zval *op2);
431 ZEND_API int ZEND_FASTCALL string_compare_function_ex(zval *op1, zval *op2, bool case_insensitive);
432 ZEND_API int ZEND_FASTCALL string_compare_function(zval *op1, zval *op2);
433 ZEND_API int ZEND_FASTCALL string_case_compare_function(zval *op1, zval *op2);
434 ZEND_API int ZEND_FASTCALL string_locale_compare_function(zval *op1, zval *op2);
435 
436 ZEND_API void         ZEND_FASTCALL zend_str_tolower(char *str, size_t length);
437 ZEND_API char*        ZEND_FASTCALL zend_str_tolower_copy(char *dest, const char *source, size_t length);
438 ZEND_API char*        ZEND_FASTCALL zend_str_tolower_dup(const char *source, size_t length);
439 ZEND_API char*        ZEND_FASTCALL zend_str_tolower_dup_ex(const char *source, size_t length);
440 ZEND_API zend_string* ZEND_FASTCALL zend_string_tolower_ex(zend_string *str, bool persistent);
441 
442 #define zend_string_tolower(str) zend_string_tolower_ex(str, 0)
443 
444 ZEND_API int ZEND_FASTCALL zend_binary_zval_strcmp(zval *s1, zval *s2);
445 ZEND_API int ZEND_FASTCALL zend_binary_zval_strncmp(zval *s1, zval *s2, zval *s3);
446 ZEND_API int ZEND_FASTCALL zend_binary_zval_strcasecmp(zval *s1, zval *s2);
447 ZEND_API int ZEND_FASTCALL zend_binary_zval_strncasecmp(zval *s1, zval *s2, zval *s3);
448 ZEND_API int ZEND_FASTCALL zend_binary_strcmp(const char *s1, size_t len1, const char *s2, size_t len2);
449 ZEND_API int ZEND_FASTCALL zend_binary_strncmp(const char *s1, size_t len1, const char *s2, size_t len2, size_t length);
450 ZEND_API int ZEND_FASTCALL zend_binary_strcasecmp(const char *s1, size_t len1, const char *s2, size_t len2);
451 ZEND_API int ZEND_FASTCALL zend_binary_strncasecmp(const char *s1, size_t len1, const char *s2, size_t len2, size_t length);
452 ZEND_API int ZEND_FASTCALL zend_binary_strcasecmp_l(const char *s1, size_t len1, const char *s2, size_t len2);
453 ZEND_API int ZEND_FASTCALL zend_binary_strncasecmp_l(const char *s1, size_t len1, const char *s2, size_t len2, size_t length);
454 
455 ZEND_API bool ZEND_FASTCALL zendi_smart_streq(zend_string *s1, zend_string *s2);
456 ZEND_API int ZEND_FASTCALL zendi_smart_strcmp(zend_string *s1, zend_string *s2);
457 ZEND_API int ZEND_FASTCALL zend_compare_symbol_tables(HashTable *ht1, HashTable *ht2);
458 ZEND_API int ZEND_FASTCALL zend_compare_arrays(zval *a1, zval *a2);
459 ZEND_API int ZEND_FASTCALL zend_compare_objects(zval *o1, zval *o2);
460 
461 ZEND_API int ZEND_FASTCALL zend_atoi(const char *str, size_t str_len);
462 ZEND_API zend_long ZEND_FASTCALL zend_atol(const char *str, size_t str_len);
463 
464 #define convert_to_null_ex(zv) convert_to_null(zv)
465 #define convert_to_boolean_ex(zv) convert_to_boolean(zv)
466 #define convert_to_long_ex(zv) convert_to_long(zv)
467 #define convert_to_double_ex(zv) convert_to_double(zv)
468 #define convert_to_string_ex(zv) convert_to_string(zv)
469 #define convert_to_array_ex(zv) convert_to_array(zv)
470 #define convert_to_object_ex(zv) convert_to_object(zv)
471 #define convert_scalar_to_number_ex(zv) convert_scalar_to_number(zv)
472 
473 ZEND_API void zend_update_current_locale(void);
474 
475 /* The offset in bytes between the value and type fields of a zval */
476 #define ZVAL_OFFSETOF_TYPE	\
477 	(offsetof(zval, u1.type_info) - offsetof(zval, value))
478 
479 #if defined(HAVE_ASM_GOTO) && !__has_feature(memory_sanitizer)
480 # define ZEND_USE_ASM_ARITHMETIC 1
481 #else
482 # define ZEND_USE_ASM_ARITHMETIC 0
483 #endif
484 
fast_long_increment_function(zval * op1)485 static zend_always_inline void fast_long_increment_function(zval *op1)
486 {
487 #if ZEND_USE_ASM_ARITHMETIC && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
488 	__asm__ goto(
489 		"addl $1,(%0)\n\t"
490 		"jo  %l1\n"
491 		:
492 		: "r"(&op1->value)
493 		: "cc", "memory"
494 		: overflow);
495 	return;
496 overflow: ZEND_ATTRIBUTE_COLD_LABEL
497 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
498 #elif ZEND_USE_ASM_ARITHMETIC && defined(__x86_64__)
499 	__asm__ goto(
500 		"addq $1,(%0)\n\t"
501 		"jo  %l1\n"
502 		:
503 		: "r"(&op1->value)
504 		: "cc", "memory"
505 		: overflow);
506 	return;
507 overflow: ZEND_ATTRIBUTE_COLD_LABEL
508 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
509 #elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
510 	__asm__ goto (
511 		"ldr x5, [%0]\n\t"
512 		"adds x5, x5, 1\n\t"
513 		"bvs %l1\n"
514 		"str x5, [%0]"
515 		:
516 		: "r"(&op1->value)
517 		: "x5", "cc", "memory"
518 		: overflow);
519 	return;
520 overflow: ZEND_ATTRIBUTE_COLD_LABEL
521 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
522 #elif PHP_HAVE_BUILTIN_SADDL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
523 	long lresult;
524 	if (UNEXPECTED(__builtin_saddl_overflow(Z_LVAL_P(op1), 1, &lresult))) {
525 		/* switch to double */
526 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
527 	} else {
528 		Z_LVAL_P(op1) = lresult;
529 	}
530 #elif PHP_HAVE_BUILTIN_SADDLL_OVERFLOW && SIZEOF_LONG_LONG == SIZEOF_ZEND_LONG
531 	long long llresult;
532 	if (UNEXPECTED(__builtin_saddll_overflow(Z_LVAL_P(op1), 1, &llresult))) {
533 		/* switch to double */
534 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
535 	} else {
536 		Z_LVAL_P(op1) = llresult;
537 	}
538 #else
539 	if (UNEXPECTED(Z_LVAL_P(op1) == ZEND_LONG_MAX)) {
540 		/* switch to double */
541 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MAX + 1.0);
542 	} else {
543 		Z_LVAL_P(op1)++;
544 	}
545 #endif
546 }
547 
fast_long_decrement_function(zval * op1)548 static zend_always_inline void fast_long_decrement_function(zval *op1)
549 {
550 #if ZEND_USE_ASM_ARITHMETIC && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
551 	__asm__ goto(
552 		"subl $1,(%0)\n\t"
553 		"jo  %l1\n"
554 		:
555 		: "r"(&op1->value)
556 		: "cc", "memory"
557 		: overflow);
558 	return;
559 overflow: ZEND_ATTRIBUTE_COLD_LABEL
560 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
561 #elif ZEND_USE_ASM_ARITHMETIC && defined(__x86_64__)
562 	__asm__ goto(
563 		"subq $1,(%0)\n\t"
564 		"jo  %l1\n"
565 		:
566 		: "r"(&op1->value)
567 		: "cc", "memory"
568 		: overflow);
569 	return;
570 overflow: ZEND_ATTRIBUTE_COLD_LABEL
571 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
572 #elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
573 	__asm__ goto (
574 		"ldr x5, [%0]\n\t"
575 		"subs x5 ,x5, 1\n\t"
576 		"bvs %l1\n"
577 		"str x5, [%0]"
578 		:
579 		: "r"(&op1->value)
580 		: "x5", "cc", "memory"
581 		: overflow);
582 	return;
583 overflow: ZEND_ATTRIBUTE_COLD_LABEL
584 	ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
585 #elif PHP_HAVE_BUILTIN_SSUBL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
586 	long lresult;
587 	if (UNEXPECTED(__builtin_ssubl_overflow(Z_LVAL_P(op1), 1, &lresult))) {
588 		/* switch to double */
589 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
590 	} else {
591 		Z_LVAL_P(op1) = lresult;
592 	}
593 #elif PHP_HAVE_BUILTIN_SSUBLL_OVERFLOW && SIZEOF_LONG_LONG == SIZEOF_ZEND_LONG
594 	long long llresult;
595 	if (UNEXPECTED(__builtin_ssubll_overflow(Z_LVAL_P(op1), 1, &llresult))) {
596 		/* switch to double */
597 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
598 	} else {
599 		Z_LVAL_P(op1) = llresult;
600 	}
601 #else
602 	if (UNEXPECTED(Z_LVAL_P(op1) == ZEND_LONG_MIN)) {
603 		/* switch to double */
604 		ZVAL_DOUBLE(op1, (double)ZEND_LONG_MIN - 1.0);
605 	} else {
606 		Z_LVAL_P(op1)--;
607 	}
608 #endif
609 }
610 
fast_long_add_function(zval * result,zval * op1,zval * op2)611 static zend_always_inline void fast_long_add_function(zval *result, zval *op1, zval *op2)
612 {
613 #if ZEND_USE_ASM_ARITHMETIC && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
614 	__asm__ goto(
615 		"movl	(%1), %%eax\n\t"
616 		"addl   (%2), %%eax\n\t"
617 		"jo     %l5\n\t"
618 		"movl   %%eax, (%0)\n\t"
619 		"movl   %3, %c4(%0)\n"
620 		:
621 		: "r"(&result->value),
622 		  "r"(&op1->value),
623 		  "r"(&op2->value),
624 		  "n"(IS_LONG),
625 		  "n"(ZVAL_OFFSETOF_TYPE)
626 		: "eax","cc", "memory"
627 		: overflow);
628 	return;
629 overflow: ZEND_ATTRIBUTE_COLD_LABEL
630 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
631 #elif ZEND_USE_ASM_ARITHMETIC && defined(__x86_64__)
632 	__asm__ goto(
633 		"movq	(%1), %%rax\n\t"
634 		"addq   (%2), %%rax\n\t"
635 		"jo     %l5\n\t"
636 		"movq   %%rax, (%0)\n\t"
637 		"movl   %3, %c4(%0)\n"
638 		:
639 		: "r"(&result->value),
640 		  "r"(&op1->value),
641 		  "r"(&op2->value),
642 		  "n"(IS_LONG),
643 		  "n"(ZVAL_OFFSETOF_TYPE)
644 		: "rax","cc", "memory"
645 		: overflow);
646 	return;
647 overflow: ZEND_ATTRIBUTE_COLD_LABEL
648 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
649 #elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
650 	__asm__ goto(
651 		"ldr    x5, [%1]\n\t"
652 		"ldr    x6, [%2]\n\t"
653 		"adds	x5, x5, x6\n\t"
654 		"bvs	%l5\n\t"
655 		"mov	w6, %3\n\t"
656 		"str	x5, [%0]\n\t"
657 		"str	w6, [%0, %c4]\n"
658 		:
659 		: "r"(&result->value),
660 		  "r"(&op1->value),
661 		  "r"(&op2->value),
662 		  "n"(IS_LONG),
663 		  "n"(ZVAL_OFFSETOF_TYPE)
664 		: "x5", "x6", "cc", "memory"
665 		: overflow);
666 	return;
667 overflow: ZEND_ATTRIBUTE_COLD_LABEL
668 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
669 #elif PHP_HAVE_BUILTIN_SADDL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
670 	long lresult;
671 	if (UNEXPECTED(__builtin_saddl_overflow(Z_LVAL_P(op1), Z_LVAL_P(op2), &lresult))) {
672 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
673 	} else {
674 		ZVAL_LONG(result, lresult);
675 	}
676 #elif PHP_HAVE_BUILTIN_SADDLL_OVERFLOW && SIZEOF_LONG_LONG == SIZEOF_ZEND_LONG
677 	long long llresult;
678 	if (UNEXPECTED(__builtin_saddll_overflow(Z_LVAL_P(op1), Z_LVAL_P(op2), &llresult))) {
679 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
680 	} else {
681 		ZVAL_LONG(result, llresult);
682 	}
683 #else
684 	/*
685 	 * 'result' may alias with op1 or op2, so we need to
686 	 * ensure that 'result' is not updated until after we
687 	 * have read the values of op1 and op2.
688 	 */
689 
690 	if (UNEXPECTED((Z_LVAL_P(op1) & LONG_SIGN_MASK) == (Z_LVAL_P(op2) & LONG_SIGN_MASK)
691 		&& (Z_LVAL_P(op1) & LONG_SIGN_MASK) != ((Z_LVAL_P(op1) + Z_LVAL_P(op2)) & LONG_SIGN_MASK))) {
692 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
693 	} else {
694 		ZVAL_LONG(result, Z_LVAL_P(op1) + Z_LVAL_P(op2));
695 	}
696 #endif
697 }
698 
fast_add_function(zval * result,zval * op1,zval * op2)699 static zend_always_inline zend_result fast_add_function(zval *result, zval *op1, zval *op2)
700 {
701 	if (EXPECTED(Z_TYPE_P(op1) == IS_LONG)) {
702 		if (EXPECTED(Z_TYPE_P(op2) == IS_LONG)) {
703 			fast_long_add_function(result, op1, op2);
704 			return SUCCESS;
705 		} else if (EXPECTED(Z_TYPE_P(op2) == IS_DOUBLE)) {
706 			ZVAL_DOUBLE(result, ((double)Z_LVAL_P(op1)) + Z_DVAL_P(op2));
707 			return SUCCESS;
708 		}
709 	} else if (EXPECTED(Z_TYPE_P(op1) == IS_DOUBLE)) {
710 		if (EXPECTED(Z_TYPE_P(op2) == IS_DOUBLE)) {
711 			ZVAL_DOUBLE(result, Z_DVAL_P(op1) + Z_DVAL_P(op2));
712 			return SUCCESS;
713 		} else if (EXPECTED(Z_TYPE_P(op2) == IS_LONG)) {
714 			ZVAL_DOUBLE(result, Z_DVAL_P(op1) + ((double)Z_LVAL_P(op2)));
715 			return SUCCESS;
716 		}
717 	}
718 	return add_function(result, op1, op2);
719 }
720 
fast_long_sub_function(zval * result,zval * op1,zval * op2)721 static zend_always_inline void fast_long_sub_function(zval *result, zval *op1, zval *op2)
722 {
723 #if ZEND_USE_ASM_ARITHMETIC && defined(__i386__) && !(4 == __GNUC__ && 8 == __GNUC_MINOR__)
724 	__asm__ goto(
725 		"movl	(%1), %%eax\n\t"
726 		"subl   (%2), %%eax\n\t"
727 		"jo     %l5\n\t"
728 		"movl   %%eax, (%0)\n\t"
729 		"movl   %3, %c4(%0)\n"
730 		:
731 		: "r"(&result->value),
732 		  "r"(&op1->value),
733 		  "r"(&op2->value),
734 		  "n"(IS_LONG),
735 		  "n"(ZVAL_OFFSETOF_TYPE)
736 		: "eax","cc", "memory"
737 		: overflow);
738 	return;
739 overflow: ZEND_ATTRIBUTE_COLD_LABEL
740 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
741 #elif ZEND_USE_ASM_ARITHMETIC && defined(__x86_64__)
742 	__asm__ goto(
743 		"movq	(%1), %%rax\n\t"
744 		"subq   (%2), %%rax\n\t"
745 		"jo     %l5\n\t"
746 		"movq   %%rax, (%0)\n\t"
747 		"movl   %3, %c4(%0)\n"
748 		:
749 		: "r"(&result->value),
750 		  "r"(&op1->value),
751 		  "r"(&op2->value),
752 		  "n"(IS_LONG),
753 		  "n"(ZVAL_OFFSETOF_TYPE)
754 		: "rax","cc", "memory"
755 		: overflow);
756 	return;
757 overflow: ZEND_ATTRIBUTE_COLD_LABEL
758 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
759 #elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
760 	__asm__ goto(
761 		"ldr    x5, [%1]\n\t"
762 		"ldr    x6, [%2]\n\t"
763 		"subs	x5, x5, x6\n\t"
764 		"bvs	%l5\n\t"
765 		"mov	w6, %3\n\t"
766 		"str	x5, [%0]\n\t"
767 		"str	w6, [%0, %c4]\n"
768 		:
769 		: "r"(&result->value),
770 		  "r"(&op1->value),
771 		  "r"(&op2->value),
772 		  "n"(IS_LONG),
773 		  "n"(ZVAL_OFFSETOF_TYPE)
774 		: "x5", "x6", "cc", "memory"
775 		: overflow);
776 	return;
777 overflow: ZEND_ATTRIBUTE_COLD_LABEL
778 	ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
779 #elif PHP_HAVE_BUILTIN_SSUBL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
780 	long lresult;
781 	if (UNEXPECTED(__builtin_ssubl_overflow(Z_LVAL_P(op1), Z_LVAL_P(op2), &lresult))) {
782 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
783 	} else {
784 		ZVAL_LONG(result, lresult);
785 	}
786 #elif PHP_HAVE_BUILTIN_SSUBLL_OVERFLOW && SIZEOF_LONG_LONG == SIZEOF_ZEND_LONG
787 	long long llresult;
788 	if (UNEXPECTED(__builtin_ssubll_overflow(Z_LVAL_P(op1), Z_LVAL_P(op2), &llresult))) {
789 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
790 	} else {
791 		ZVAL_LONG(result, llresult);
792 	}
793 #else
794 	ZVAL_LONG(result, Z_LVAL_P(op1) - Z_LVAL_P(op2));
795 
796 	if (UNEXPECTED((Z_LVAL_P(op1) & LONG_SIGN_MASK) != (Z_LVAL_P(op2) & LONG_SIGN_MASK)
797 		&& (Z_LVAL_P(op1) & LONG_SIGN_MASK) != (Z_LVAL_P(result) & LONG_SIGN_MASK))) {
798 		ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
799 	}
800 #endif
801 }
802 
zend_fast_equal_strings(zend_string * s1,zend_string * s2)803 static zend_always_inline bool zend_fast_equal_strings(zend_string *s1, zend_string *s2)
804 {
805 	if (s1 == s2) {
806 		return 1;
807 	} else if (ZSTR_VAL(s1)[0] > '9' || ZSTR_VAL(s2)[0] > '9') {
808 		return zend_string_equal_content(s1, s2);
809 	} else {
810 		return zendi_smart_streq(s1, s2);
811 	}
812 }
813 
fast_equal_check_function(zval * op1,zval * op2)814 static zend_always_inline bool fast_equal_check_function(zval *op1, zval *op2)
815 {
816 	if (EXPECTED(Z_TYPE_P(op1) == IS_LONG)) {
817 		if (EXPECTED(Z_TYPE_P(op2) == IS_LONG)) {
818 			return Z_LVAL_P(op1) == Z_LVAL_P(op2);
819 		} else if (EXPECTED(Z_TYPE_P(op2) == IS_DOUBLE)) {
820 			return ((double)Z_LVAL_P(op1)) == Z_DVAL_P(op2);
821 		}
822 	} else if (EXPECTED(Z_TYPE_P(op1) == IS_DOUBLE)) {
823 		if (EXPECTED(Z_TYPE_P(op2) == IS_DOUBLE)) {
824 			return Z_DVAL_P(op1) == Z_DVAL_P(op2);
825 		} else if (EXPECTED(Z_TYPE_P(op2) == IS_LONG)) {
826 			return Z_DVAL_P(op1) == ((double)Z_LVAL_P(op2));
827 		}
828 	} else if (EXPECTED(Z_TYPE_P(op1) == IS_STRING)) {
829 		if (EXPECTED(Z_TYPE_P(op2) == IS_STRING)) {
830 			return zend_fast_equal_strings(Z_STR_P(op1), Z_STR_P(op2));
831 		}
832 	}
833 	return zend_compare(op1, op2) == 0;
834 }
835 
fast_equal_check_long(zval * op1,zval * op2)836 static zend_always_inline bool fast_equal_check_long(zval *op1, zval *op2)
837 {
838 	if (EXPECTED(Z_TYPE_P(op2) == IS_LONG)) {
839 		return Z_LVAL_P(op1) == Z_LVAL_P(op2);
840 	}
841 	return zend_compare(op1, op2) == 0;
842 }
843 
fast_equal_check_string(zval * op1,zval * op2)844 static zend_always_inline bool fast_equal_check_string(zval *op1, zval *op2)
845 {
846 	if (EXPECTED(Z_TYPE_P(op2) == IS_STRING)) {
847 		return zend_fast_equal_strings(Z_STR_P(op1), Z_STR_P(op2));
848 	}
849 	return zend_compare(op1, op2) == 0;
850 }
851 
fast_is_identical_function(zval * op1,zval * op2)852 static zend_always_inline bool fast_is_identical_function(zval *op1, zval *op2)
853 {
854 	if (Z_TYPE_P(op1) != Z_TYPE_P(op2)) {
855 		return 0;
856 	} else if (Z_TYPE_P(op1) <= IS_TRUE) {
857 		return 1;
858 	}
859 	return zend_is_identical(op1, op2);
860 }
861 
fast_is_not_identical_function(zval * op1,zval * op2)862 static zend_always_inline bool fast_is_not_identical_function(zval *op1, zval *op2)
863 {
864 	if (Z_TYPE_P(op1) != Z_TYPE_P(op2)) {
865 		return 1;
866 	} else if (Z_TYPE_P(op1) <= IS_TRUE) {
867 		return 0;
868 	}
869 	return !zend_is_identical(op1, op2);
870 }
871 
872 /* buf points to the END of the buffer */
zend_print_ulong_to_buf(char * buf,zend_ulong num)873 static zend_always_inline char *zend_print_ulong_to_buf(char *buf, zend_ulong num) {
874 	*buf = '\0';
875 	do {
876 		*--buf = (char) (num % 10) + '0';
877 		num /= 10;
878 	} while (num > 0);
879 	return buf;
880 }
881 
882 /* buf points to the END of the buffer */
zend_print_long_to_buf(char * buf,zend_long num)883 static zend_always_inline char *zend_print_long_to_buf(char *buf, zend_long num) {
884 	if (num < 0) {
885 	    char *result = zend_print_ulong_to_buf(buf, ~((zend_ulong) num) + 1);
886 	    *--result = '-';
887 		return result;
888 	} else {
889 	    return zend_print_ulong_to_buf(buf, num);
890 	}
891 }
892 
893 ZEND_API zend_string* ZEND_FASTCALL zend_long_to_str(zend_long num);
894 ZEND_API zend_string* ZEND_FASTCALL zend_ulong_to_str(zend_ulong num);
895 ZEND_API zend_string* ZEND_FASTCALL zend_u64_to_str(uint64_t num);
896 ZEND_API zend_string* ZEND_FASTCALL zend_i64_to_str(int64_t num);
897 ZEND_API zend_string* ZEND_FASTCALL zend_double_to_str(double num);
898 
zend_unwrap_reference(zval * op)899 static zend_always_inline void zend_unwrap_reference(zval *op) /* {{{ */
900 {
901 	if (Z_REFCOUNT_P(op) == 1) {
902 		ZVAL_UNREF(op);
903 	} else {
904 		Z_DELREF_P(op);
905 		ZVAL_COPY(op, Z_REFVAL_P(op));
906 	}
907 }
908 /* }}} */
909 
910 
911 END_EXTERN_C()
912 
913 #endif
914