[php-src] Issue #10576: No escaping in `zend_dump_const` output

From: Date: Mon, 13 Feb 2023 08:32:52 +0000
Subject: [php-src] Issue #10576: No escaping in `zend_dump_const` output
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-243719@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/10576 Author: SerafimArts ### Description The following code: ```php <?php substr_count($stmt, '")') ``` After some optimization steps, it outputs the following opcodes: Resulted in this output: ``` 0026 SEND_VAR CV1($current) 1 0027 SEND_VAL string("("") 2 0028 V14 = DO_ICALL ``` Please pay attention to instruction 0027. This expression cannot be correctly recognized during any automated analysis of the opcode dump. Even if I take the first and last occurrences of string(" and "), then such instructions can disrupt the work of parser: ``` 0001 INIT_STATIC_METHOD_CALL 0 string("")") string("string("") ``` I understand that from the point of view of grammar, this is impossible in principle, but similar cases may arise. The problem is here: https://github.com/php/php-src/blob/PHP-8.2/Zend/Optimizer/zend_dump.c#L69 I suggest adding character \\, " (and perhaps \n) escaping so that the output of opcodes can be parsed automatically. However, before sending a PR, I would like to ask if there is already a ready-made function that escapes the specified sequences, instead of Z_STRVAL_P.

« previous php.bugs (#243719) next »