Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60625
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
References: <5262BA67-53D2-4D19-9AD6-B1BFDABAC32E@sektioneins.de>
In-Reply-To: <5262BA67-53D2-4D19-9AD6-B1BFDABAC32E@sektioneins.de>
Mime-Version: 1.0 (1.0)
Date: Mon, 21 May 2012 20:41:48 +0800
Message-ID: <-7697815941710803116@unknownmsgid>
To: Stefan Esser <stefan.esser@sektioneins.de>
Cc: Mailing-List php <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] zend_execute_internal hook missing from PHP 5
From: laruence@gmail.com (Xinchen Hui)

Sent from my iPhone

=E5=9C=A8 2012-5-21=EF=BC=8C18:42=EF=BC=8CStefan Esser <stefan.esser@sektio=
neins.de> =E5=86=99=E9=81=93=EF=BC=9A

> Hi,
>
> it recently came to my attention that the function whitelist and blacklis=
t feature inside Suhosin is easily bypassable since PHP 5.0.
>
> The reason for this is that PHP is no longer calling the zend_execute_int=
ernal() hook if a function is called from another function (via zend_call_f=
unction)
>
> In the days of PHP 4 the code looked like this:
>
>        if (!zend_execute_internal) {
>            ((zend_internal_function *) EX(function_state).function)->hand=
ler(EX(opline)->extended_value, EX(Ts)[EX(opline)->result.u.var].var.ptr, E=
X(object).ptr, 1 TSRMLS_CC);
>        } else {
>            zend_execute_internal(&execute_data, 1 TSRMLS_CC);
>        }
>
> Nowadays (since PHP 5.0) the code was moved from call_user_function_ex to=
 zend_call_function and just looks like this:
>
>        ((zend_internal_function *) EX(function_state).function)->handler(=
fci->param_count, *fci->retval_ptr_ptr, fci->retval_ptr_ptr, fci->object_pt=
r, 1 TSRMLS_CC);
>
>
> While this has no immediate impact for average PHP users, it basically ki=
lls the possibility for an extension like Suhosin to catch all function sta=
rts.
Actually, there is one, use user opcode handler hook the fcall series
opcodes, that is how I did in taint extension.

http://svn.php.net/viewvc/pecl/taint/trunk/taint.c?view=3Dmarkup&pathrev=3D=
325586
line 995

Thanks
> This should also be a problem for your DTRACE support. And IIRC Xdebug wa=
s hooking this point (at least in the past), too.
>
> My suggestion is to change the code to call the hook again.
>
> Regards,
> Stefan
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>