[php-src] Issue #10576: No escaping in `zend_dump_const` output
| From: | SerafimArts | Date: | Mon, 13 Feb 2023 08:32:52 +0000 |
| Subject: | [php-src] Issue #10576: No escaping in `zend_dump_const` output | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243719@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10576
Author: SerafimArts
### Description
The following code:
```php
<?php
substr_count($stmt, '")')
```
After some optimization steps, it outputs the following opcodes:
Resulted in this output:
```
0026 SEND_VAR CV1($current) 1
0027 SEND_VAL string("("") 2
0028 V14 = DO_ICALL
```
Please pay attention to instruction 0027.
This expression cannot be correctly recognized during any automated analysis of the opcode dump.
Even if I take the first and last occurrences of
string(" and
"), then such instructions can disrupt the work of parser:
```
0001 INIT_STATIC_METHOD_CALL 0 string("")") string("string("")
```
I understand that from the point of view of grammar, this is impossible in principle, but similar
cases may arise.
The problem is here: https://github.com/php/php-src/blob/PHP-8.2/Zend/Optimizer/zend_dump.c#L69
I suggest adding character \\, " (and perhaps \n)
escaping so that the output of opcodes can be parsed automatically.
However, before sending a PR, I would like to ask if there is already a ready-made function that
escapes the specified sequences, instead of Z_STRVAL_P.