java-topology/docs/tickets/php-0001-named-arg-linear-scan-compile-time.md

php-0001 — zend_compile.c: O(n²) linear scan for named argument position

Field	Value
ID	php-0001
Target	PHP
File	Zend/zend_compile.c
Lines	3755–3766, 3784, 3822
CWE	CWE-407 (Algorithmic Complexity)
Severity	HIGH
Status	PATCHED

Description

zend_get_arg_num() performs a linear scan over fn->common.num_args entries to locate a named argument by string comparison:

static uint32_t zend_get_arg_num(const zend_function *fn, const zend_string *arg_name) {
    // TODO: Caching?
    for (uint32_t i = 0; i < fn->common.num_args; i++) {
        zend_arg_info *arg_info = &fn->op_array.arg_info[i];
        if (zend_string_equals(arg_info->name, arg_name)) {
            return i + 1;
        }
    }
    return (uint32_t) -1;
}

This is called from zend_compile_args() which iterates over all args->children at compile time. For a function with M parameters called with N named arguments the total cost is O(N × M). The upstream comment // TODO: Caching? acknowledges the defect.

The companion runtime function zend_get_arg_offset_by_name() in zend_execute.c (line 5479) carries the same structure with an explicit // TODO: Use a hash table? comment, and is subject to identical quadratic behavior on cache miss.

Reproduction

// Function with 50 named parameters, called with all 50 named — 50×50 = 2500 scans
function wide(
    $p0, $p1, $p2, ..., $p49
) {}
// Each named arg triggers zend_get_arg_num linear scan over 50 entries
wide(p49: 1, p48: 2, ..., p0: 50);

Fix

Build a HashTable from arg_name → position once per function signature and cache it on the zend_function (or use the existing per-opcode cache slot for the runtime path, which already has infrastructure but is not used for the compile-time path).

Complexity

Metric	Before	After
Per named-arg lookup	O(M)	O(1)
N named args, M params	O(N×M)	O(N + M)
Speedup (N=M=50)	1×	~50×