Patch 70173_Standalone_Reproduction.c for Scripting Engine problem Bug #70173

Patch version 2015-08-08 21:55 UTC

• 2015-08-08 21:55 UTC [diff to current]

Developer: rainer.jung@kippdata.de

#include <stdint.h>
#include <stdio.h>

// From main/php_config.h

#define WORDS_BIGENDIAN
#define SIZEOF_SIZE_T 4

// From Zend/zend_long.h

typedef int32_t zend_long;

// From Zend/zend_types.h

#ifdef WORDS_BIGENDIAN
# define ZEND_ENDIAN_LOHI(lo, hi)      hi; lo;
#else
# define ZEND_ENDIAN_LOHI(lo, hi)      lo; hi;
#endif

#define zend_refcounted void

typedef union _zend_value {
    zend_long     lval;             /* long value */
    double        dval;             /* double value */
    zend_refcounted  *counted;
    struct {
        ZEND_ENDIAN_LOHI(
            uint32_t w1,
            uint32_t w2)
    } ww;
} zend_value;

typedef struct _zval_struct     zval;
struct _zval_struct {
    zend_value    value;            /* value */
    union {
        uint32_t type_info;
    } u1;
};

#define Z_TYPE_INFO(zval)               (zval).u1.type_info
#define Z_TYPE_INFO_P(zval_p)       Z_TYPE_INFO(*(zval_p))

#define Z_COUNTED(zval)             (zval).value.counted
#define Z_COUNTED_P(zval_p)             Z_COUNTED(*(zval_p))

#if SIZEOF_SIZE_T == 4
# define ZVAL_COPY_VALUE_EX(z, v, gc, t) \
    do {                                 \
        uint32_t _w2 = v->value.ww.w2;   \
        Z_COUNTED_P(z) = gc;             \
        z->value.ww.w2 = _w2;            \
        Z_TYPE_INFO_P(z) = t;            \
    } while (0)
#else
# error "Unknown SIZEOF_SIZE_T"
#endif

#define ZVAL_COPY_VALUE(z, v)                    \
    do {                                         \
        zval *_z1 = (z);                         \
        const zval *_z2 = (v);                   \
        zend_refcounted *_gc = Z_COUNTED_P(_z2); \
        uint32_t _t = Z_TYPE_INFO_P(_z2);        \
        ZVAL_COPY_VALUE_EX(_z1, _z2, _gc, _t);   \
    } while (0)


int main() {
    zval v;
    zval z;
    v.value.dval = 2900000000.0f;
    z.value.ww.w1 = 0;
    z.value.ww.w2 = 0;
    ZVAL_COPY_VALUE(&z, &v);
    fprintf(stdout, "Source: lval=%ld (0x%p), dval=%f (0x%p), w1=%d (0x%p), w2=%d (0x%p)\n",
            v.value.lval, &v.value.lval, v.value.dval, &v.value.dval,
            v.value.ww.w1, &v.value.ww.w1, v.value.ww.w2, &v.value.ww.w2);
    fprintf(stdout, "Copied: lval=%ld (0x%p), dval=%f (0x%p), w1=%d (0x%p), w2=%d (0x%p)\n",
            z.value.lval, &z.value.lval, z.value.dval, &z.value.dval,
            z.value.ww.w1, &z.value.ww.w1, z.value.ww.w2, &z.value.ww.w2);
}
#include <stdint.h>
#include <stdio.h>

// From main/php_config.h

#define WORDS_BIGENDIAN
#define SIZEOF_SIZE_T 4

// From Zend/zend_long.h

typedef int32_t zend_long;

// From Zend/zend_types.h

#ifdef WORDS_BIGENDIAN
# define ZEND_ENDIAN_LOHI(lo, hi)      hi; lo;
#else
# define ZEND_ENDIAN_LOHI(lo, hi)      lo; hi;
#endif

#define zend_refcounted void

typedef union _zend_value {
    zend_long     lval;             /* long value */
    double        dval;             /* double value */
    zend_refcounted  *counted;
    struct {
        ZEND_ENDIAN_LOHI(
            uint32_t w1,
            uint32_t w2)
    } ww;
} zend_value;

typedef struct _zval_struct     zval;
struct _zval_struct {
    zend_value    value;            /* value */
    union {
        uint32_t type_info;
    } u1;
};

#define Z_TYPE_INFO(zval)               (zval).u1.type_info
#define Z_TYPE_INFO_P(zval_p)       Z_TYPE_INFO(*(zval_p))

#define Z_COUNTED(zval)             (zval).value.counted
#define Z_COUNTED_P(zval_p)             Z_COUNTED(*(zval_p))

#if SIZEOF_SIZE_T == 4
# define ZVAL_COPY_VALUE_EX(z, v, gc, t) \
    do {                                 \
        uint32_t _w2 = v->value.ww.w2;   \
        Z_COUNTED_P(z) = gc;             \
        z->value.ww.w2 = _w2;            \
        Z_TYPE_INFO_P(z) = t;            \
    } while (0)
#else
# error "Unknown SIZEOF_SIZE_T"
#endif

#define ZVAL_COPY_VALUE(z, v)                    \
    do {                                         \
        zval *_z1 = (z);                         \
        const zval *_z2 = (v);                   \
        zend_refcounted *_gc = Z_COUNTED_P(_z2); \
        uint32_t _t = Z_TYPE_INFO_P(_z2);        \
        ZVAL_COPY_VALUE_EX(_z1, _z2, _gc, _t);   \
    } while (0)


int main() {
    zval v;
    zval z;
    v.value.dval = 2900000000.0f;
    z.value.ww.w1 = 0;
    z.value.ww.w2 = 0;
    ZVAL_COPY_VALUE(&z, &v);
    fprintf(stdout, "Source: lval=%ld (0x%p), dval=%f (0x%p), w1=%d (0x%p), w2=%d (0x%p)\n",
            v.value.lval, &v.value.lval, v.value.dval, &v.value.dval,
            v.value.ww.w1, &v.value.ww.w1, v.value.ww.w2, &v.value.ww.w2);
    fprintf(stdout, "Copied: lval=%ld (0x%p), dval=%f (0x%p), w1=%d (0x%p), w2=%d (0x%p)\n",
            z.value.lval, &z.value.lval, z.value.dval, &z.value.dval,
            z.value.ww.w1, &z.value.ww.w1, z.value.ww.w2, &z.value.ww.w2);
}