PHP Zend Engine — CWE-407 Analysis
====================================

.. contents:: :local:

Overview
--------

The PHP Zend Engine is the core runtime for PHP, executing approximately 80% of web server
requests globally. Its OPcache optimizer performs SSA construction, CFG analysis, dataflow
analysis (DFG), and sparse conditional dataflow (SCDF) over PHP opcode graphs.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 6 candidates from ``Zend/Optimizer/``. All triaged as false positives.

Triage Notes
------------

All 6 candidates were calls to ``zend_bitset_in()``. Investigation confirmed:

.. code-block:: c

   /* Zend/zend_bitset.h:130 */
   static inline bool zend_bitset_in(zend_bitset set, uint32_t n)
   {
       return ZEND_BIT_TEST(set, n);
   }

``ZEND_BIT_TEST`` expands to a single bitwise AND::

   set[n / ZEND_BITSET_ELM_SIZE] & (1UL << (n % ZEND_BITSET_ELM_SIZE))

This is O(1). The DFG (``zend_dfg.c``, ``zend_dfg.h``) and SCDF (``scdf.c``) passes
use a word-array bitset indexed by variable number and basic block number. All membership
tests are O(1) bit reads.

The Zend Engine was the highest-probability target among web infrastructure components
because of its optimizer. The implementation is correct.

Key Finding
-----------

PHP OPcache's optimizer uses a proper bitset (array of machine words) for all dataflow
analysis visited-state tracking. The 6 ``zend_bitset_in`` calls all resolve to a single
machine instruction. No CWE-407 defect.

References
----------

* Scan result: ``tools/scan-results/php-zend.txt``
