Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:44540
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pooteeweet.org from 88.198.8.16 cause and error)
To: Matt Wilmas <php_lists@realplain.com>
In-Reply-To: <7435CCB5C8694BDCAAC90C165570A3E1@pc1>
References: <7435CCB5C8694BDCAAC90C165570A3E1@pc1>
Message-ID: <48B6EF7D-E66E-49B8-B798-ABBBE92AB8F6@pooteeweet.org>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Date: Tue, 30 Jun 2009 15:25:53 +0200
Cc:  <internals@lists.php.net>
Subject: Re: [PHP-DEV] [PATCH] create_function/zend_eval_string aren't binary-safe
From: mls@pooteeweet.org (Lukas Kahwe Smith)


On 03.06.2009, at 20:45, Matt Wilmas wrote:

> Hi all,
>
> I first noticed this with preg_replace()'s /e modifier (SO many  
> other issues with that...), but it also happens with  
> create_function() and a few other places where zend_eval_string() is  
> used.  Other code evaluation in PHP is binary-safe, so it seems like  
> these areas should be as well?  In case an example is needed:
>
> $func = create_function('', "return strlen('Test\0string');");
> echo $func();
>
> Patches:
> http://realplain.com/php/binary_eval_string.diff
> http://realplain.com/php/binary_eval_string_5_3.diff
>
> Can they be applied?  (Also a small optimization by eliminating  
> strlen() usage.)  May want to verify the ext/interbase change.
>
> I noticed there are several zend_eval_string() references in PECL  
> sources [1], which would be a problem after adding a string length  
> parameter...  How is that handled?  Should the updated function be  
> eval_stringL instead and add macros for compatibility?
>
> [1] http://lxr.php.net/ident?i=zend_eval_string


should this be applied now as it hasnt been applied yet, afaik?

regards,
Lukas Kahwe Smith
mls@pooteeweet.org