PH7_CompileScript() and GenStateCompileChunk() called from several places allows invalid constructions

belliash commented

2018-08-10 22:23:07 +02:00

Owner

GenStateCompileChunk() is a function that compiles a given chunk of code. It is called from PH7_CompilePHP(). PH7_CompilePHP() is called from PH7_CompileScript(). Finally, PH7_CompileScript() is called from ProcessScript() or VmEvalChunk(). Below more detailed call schema:

ph7_compile_file()
-> ProcessScript()
	-> PH7_CompileScript()
		-> PH7_CompilePHP()
			-> GenStateCompileChunk()


vm_builtin_eval()
-> VmEvalChunk()
	-> PH7_CompileScript()
		-> PH7_CompilePHP()
			-> GenStateCompileChunk()


vm_builtin_require()
 -> VmExecIncludedFile()
	-> VmEvalChunk()
		-> PH7_CompileScript()
			-> PH7_CompilePHP()
				-> GenStateCompileChunk()

Additionally, GenStateCompileChunk() is also called from PH7_CompileBlock(), that is called from every functions compiling most constructs (eg. if, for, switch, do, while, functions, methods, etc...).

Because GenStateCompileChunk() is called when new file is loaded as well as when function body or if construct is compiled, the same code is executed then. This leads to strange situations. PH7 Engine allows to define a class inside another method. To be honest it allows to define a class anywhere GenStateCompileChunk() is called from. Thus, it is possible to execute below code:

class A {
    function B() {
        class C {
            function D() {
                [...]
            }
        }
    }
}

And this is not really a PH7 problem, because the same code can be successfully executed with PHP ...

GenStateCompileChunk() is a function that compiles a given chunk of code. It is called from PH7_CompilePHP(). PH7_CompilePHP() is called from PH7_CompileScript(). Finally, PH7_CompileScript() is called from ProcessScript() or VmEvalChunk(). Below more detailed call schema: ph7_compile_file() -> ProcessScript() -> PH7_CompileScript() -> PH7_CompilePHP() -> GenStateCompileChunk() vm_builtin_eval() -> VmEvalChunk() -> PH7_CompileScript() -> PH7_CompilePHP() -> GenStateCompileChunk() vm_builtin_require() -> VmExecIncludedFile() -> VmEvalChunk() -> PH7_CompileScript() -> PH7_CompilePHP() -> GenStateCompileChunk() Additionally, GenStateCompileChunk() is also called from PH7_CompileBlock(), that is called from every functions compiling most constructs (eg. if, for, switch, do, while, functions, methods, etc...). Because GenStateCompileChunk() is called when new file is loaded as well as when function body or __if__ construct is compiled, the same code is executed then. This leads to strange situations. PH7 Engine allows to define a class inside another method. To be honest it allows to define a class anywhere GenStateCompileChunk() is called from. Thus, it is possible to execute below code: class A { function B() { class C { function D() { [...] } } } } And this is not really a PH7 problem, because the same code can be successfully executed with PHP ...