russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
52 lines
1.6 KiB
ReStructuredText
52 lines
1.6 KiB
ReStructuredText
PHP Zend Engine — CWE-407 Analysis
|
|
====================================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
The PHP Zend Engine is the core runtime for PHP, executing approximately 80% of web server
|
|
requests globally. Its OPcache optimizer performs SSA construction, CFG analysis, dataflow
|
|
analysis (DFG), and sparse conditional dataflow (SCDF) over PHP opcode graphs.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
Scan returned 6 candidates from ``Zend/Optimizer/``. All triaged as false positives.
|
|
|
|
Triage Notes
|
|
------------
|
|
|
|
All 6 candidates were calls to ``zend_bitset_in()``. Investigation confirmed:
|
|
|
|
.. code-block:: c
|
|
|
|
/* Zend/zend_bitset.h:130 */
|
|
static inline bool zend_bitset_in(zend_bitset set, uint32_t n)
|
|
{
|
|
return ZEND_BIT_TEST(set, n);
|
|
}
|
|
|
|
``ZEND_BIT_TEST`` expands to a single bitwise AND::
|
|
|
|
set[n / ZEND_BITSET_ELM_SIZE] & (1UL << (n % ZEND_BITSET_ELM_SIZE))
|
|
|
|
This is O(1). The DFG (``zend_dfg.c``, ``zend_dfg.h``) and SCDF (``scdf.c``) passes
|
|
use a word-array bitset indexed by variable number and basic block number. All membership
|
|
tests are O(1) bit reads.
|
|
|
|
The Zend Engine was the highest-probability target among web infrastructure components
|
|
because of its optimizer. The implementation is correct.
|
|
|
|
Key Finding
|
|
-----------
|
|
|
|
PHP OPcache's optimizer uses a proper bitset (array of machine words) for all dataflow
|
|
analysis visited-state tracking. The 6 ``zend_bitset_in`` calls all resolve to a single
|
|
machine instruction. No CWE-407 defect.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/php-zend.txt``
|