rfc:range_checks_for_64_bit

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
rfc:range_checks_for_64_bit [2015/08/24 15:17] – abrfc:range_checks_for_64_bit [2017/09/22 13:28] (current) – external edit 127.0.0.1
Line 1: Line 1:
-====== PHP RFC: Range checks for external libary APIs in 64-bit builds ======+====== PHP RFC: Range checks for external and internal APIs in 64-bit builds ======
   * Version: 0.9   * Version: 0.9
   * Date: 2015-08-24   * Date: 2015-08-24
   * Author: Anatol Belski, ab@php.net   * Author: Anatol Belski, ab@php.net
-  * Status: Draft+  * Status: withdrawn
  
 ===== Introduction ===== ===== Introduction =====
Line 10: Line 10:
  
 Other aspects of the mentioned issue are internal PHP functions not requiring 64-bit functionality so behaving same way on 64-bit when having possibly non 64-bit argument types in signatures. Yet another impact might be also comparison of variables with 64- and 32-bit, signed and unsigned types.  Other aspects of the mentioned issue are internal PHP functions not requiring 64-bit functionality so behaving same way on 64-bit when having possibly non 64-bit argument types in signatures. Yet another impact might be also comparison of variables with 64- and 32-bit, signed and unsigned types. 
 +
 +===== Proposal =====
 +
 +It is suggested to implement additional formats for ZPP, that are explicitly require
 +
 +  * strings with 32-bit length (both signed and unsigned)
 +  * 32-bit integers (both signed and unsigned)
 +
 +on affected platforms only. In addition, it is suggested to implement a set of macros for range checks and comparison.
 +
 +The mentioned implementations won't affect places where no range overflows can happen. The checks functionality will be excluded automatically at the compile time on the platform/build combinations where it does not make sense. For example on the platforms like ILP64 these checks make no sense.
 +
 +All the extensions linking to the libraries or places using internal functions of the mentioned kind have to be adapted with the new ZPP and possibly macro handling.
  
 ==== Proposed macros for 32-bit int checks ==== ==== Proposed macros for 32-bit int checks ====
Line 20: Line 33:
 # define ZEND_LONG_INT_OVFL(zlong) ((zlong) > (zend_long)INT_MAX) # define ZEND_LONG_INT_OVFL(zlong) ((zlong) > (zend_long)INT_MAX)
 # define ZEND_LONG_INT_UDFL(zlong) ((zlong) < (zend_long)INT_MIN) # define ZEND_LONG_INT_UDFL(zlong) ((zlong) < (zend_long)INT_MIN)
 +#endif
 +
 +#if SIZEOF_INT == SIZEOF_ZEND_LONG
 +# define ZEND_LONG_UINT_OVFL(zl) (0)
 +#else
 +# define ZEND_LONG_UINT_OVFL(zlong) ((zlong) < 0 || (zlong) > (zend_long)UINT_MAX)
 #endif #endif
  
 #define ZEND_SIZE_T_INT_OVFL(size) ((size) > (size_t)INT_MAX) #define ZEND_SIZE_T_INT_OVFL(size) ((size) > (size_t)INT_MAX)
 +
 +#if SIZEOF_INT == SIZEOF_SIZE_T
 +# define ZEND_SIZE_T_UINT_OVFL(size) (0)
 +#else
 +# define ZEND_SIZE_T_UINT_OVFL(size) ((size) > (size_t)UINT_MAX)
 +#endif
  
 </code> </code>
  
-==== Example of an affected places ====+==== Proposed additional macros to simplify signed/unsigned comparisons ====
  
-Here is the real case from the current code base, the irrelevant declarations and code are removed. Consider the signature in the underlaying API [[http://xmlsoft.org/html/libxml-parser.html#xmlReadMemory]]+<code c> 
 +#define ZEND_SIZE_T_GT_ZEND_LONG(size, zlong) ((zlong) < 0 || (size) > (size_t)(zlong)) 
 +#define ZEND_SIZE_T_GTE_ZEND_LONG(size, zlong) ((zlong) < 0 || (size) >= (size_t)(zlong)) 
 +#define ZEND_SIZE_T_LT_ZEND_LONG(size, zlong) ((zlong) >= 0 && (size) < (size_t)(zlong)) 
 +#define ZEND_SIZE_T_LTE_ZEND_LONG(size, zlong) ((zlong) >= 0 && (size) <= (size_t)(zlong)) 
 +</code>
  
 +All the macros should be put into a dedicated header, so any extensions and improvements can follow up in the scope. 
 +
 +==== Proposed ZPP changes ====
 +
 +Introducing new formats
 +
 +  * 'q' - string with signed 32-bit length
 +  * 'r' - string with unsigned 32-bit length
 +  * 'i' - signed 32-bit integer
 +  * 'u' - unsigned 32-bit integer
 +
 +The behaviour of the options:
 +
 +  * if string length exceeds 32-bit range, ZPP should fail the usual way
 +  * if the passed numeric option would overflow a 32-bit integer, ZPP should fail the usual way
 +
 +With the usual way the behavior of ZPP is meant, that is expected at the concrete place. It could be an Error or another Throwable, or a warning. It might depend on other upcoming RFCs and has to be implemented accordingly.
 +
 +==== Example affected place ====
 +
 +Here is the real case from the current code base, the irrelevant declarations and code are removed. Consider the signature in the underlaying API [[http://xmlsoft.org/html/libxml-parser.html#xmlReadMemory]]
  
 +The original piece of code
  
 <code c> <code c>
Line 52: Line 104:
 </code> </code>
  
-The proposed way to fix it using ZPP+The proposed way to fix it using ZPP. Note that 'q' is used for string input and 'i' is used for options.
 <code c> <code c>
 PHP_FUNCTION(simplexml_load_string) PHP_FUNCTION(simplexml_load_string)
Line 101: Line 153:
 } }
 </code> </code>
- 
- 
-===== Proposal ===== 
- 
-It is suggested to implement two additional formats for ZPP, that are explicitly require 
- 
-  * strings with 32-bit length 
-  * 32-bit integers 
- 
-on affected platforms only. In addition, it is suggested to implement a set of macros for range checks and comparison. 
- 
-The mentioned implementations won't affect places where no range overflows can happen. The checks functionality will be excluded automatically at the compile time on the platform/build combinations where it does not make sense. For example on the platforms like ILP64 these checks make no sense. 
- 
-All the extensions linking to the libraries or places using internal functions of the mentioned kind have to be adapted with the new ZPP and possibly macro handling. 
  
 ===== Backward Incompatible Changes ===== ===== Backward Incompatible Changes =====
-Several new warnings or harder error handling might be introduced with the new range checks. This +Several new warnings or harder error handling might be introduced with the new range checks. However this should only affect the edge cases where the errors are actually happen and are catched. The general behaviour has to comply with the behavior in the core.
  
 ===== Proposed PHP Version(s) ===== ===== Proposed PHP Version(s) =====
Line 145: Line 183:
  
 ===== Future Scope ===== ===== Future Scope =====
-This sections details areas where the feature might be improved in future, but that are not currently proposed in this RFC.+ 
 +Having this minimalistic start as a base, the topic of overflows in the mathematical operations can be entered. This topic is not handled by this RFC. 
 + 
 +Also, some good patterns for other cases can be added later by need. Like compare int vs size_t, or compare variables with different sizes.
  
 ===== Proposed Voting Choices ===== ===== Proposed Voting Choices =====
Line 152: Line 193:
  
 ===== Patches and Tests ===== ===== Patches and Tests =====
-TBD.+The implementation of the base functionality is trivial and can be done if the proposed strategy is accepted. Many places in the core extensions related to libxml2, openssl, tidy, etc. are obvious and will be addressed already before merging.
  
 ===== Implementation ===== ===== Implementation =====
rfc/range_checks_for_64_bit.txt · Last modified: 2017/09/22 13:28 by 127.0.0.1

Page Tools