Calling token_get_all from c program - php

Question

I'm trying to write a c program that can analyse PHP scripts for various reasons. I need to call token_get_all from the PHP core library, but I'm struggling mightily with it. I've compiled the php7 master branch statically and linked it to my program. I'll post a couple of code snippets as I've tried many ways of calling this function and keep running into errors of one type or another.
This snippet gets the farthest when I execute it:
int main(void)
{
zval function_name, params[1], return_value, param;
ZVAL_NEW_STR(&function_name, zend_string_init("token_get_all", strlen("token_get_all"), 1));
printf("Got here\n");
ZVAL_NEW_STR(&params[0], zend_string_init("<?php $x = 1;", strlen("<?php $x = 1;"), 1));
int ret;
printf("Calling function\n");
ret = call_user_function(CG(function_table), NULL, &function_name, &return_value, 1, params TSRMLS_CC);
printf("%i", ret);
}
When it gets to call_user_function, it segfaults. Valgrind output:
==11451== 1 errors in context 1 of 1:
==11451== Invalid read of size 8
==11451== at 0x40268C: parse_php (parser.c:73)
==11451== by 0x402730: parse_php_file (parser.c:95)
==11451== by 0x4029B2: main (parse-script-main.c:14)
==11451== Address 0x0 is not stack'd, malloc'd or (recently) free'd
parser.c:73 is the line of call_user_function.
I'll post this as well, though it may be a separate question. If I change the way I initialize function_name or my lone parameter I wind up with a different segfault. Consider this:
int main(void)
{
zval function_name, params[1], return_value, param;
ZVAL_STRING(&function_name, "token_get_all");
printf("Got here\n");
ZVAL_NEW_STR(&params[0], zend_string_init("<?php $x = 1;", strlen("<?php $x = 1;"), 1));
int ret;
printf("Calling function\n");
ret = call_user_function(CG(function_table), NULL, &function_name, &return_value, 1, params TSRMLS_CC);
printf("%i", ret);
}
This gives me another segfault on the ZVAL_STRING line:
==11481== 1 errors in context 1 of 1:
==11481== Invalid read of size 8
==11481== at 0x407DF5: _emalloc (zend_alloc.c:2376)
==11481== by 0x402559: zend_string_alloc (zend_string.h:121)
==11481== by 0x4025C2: zend_string_init (zend_string.h:157)
==11481== by 0x402639: parse_php (parser.c:65)
==11481== by 0x402747: parse_php_file (parser.c:95)
==11481== by 0x4029C9: main (parse-script-main.c:14)
==11481== Address 0x0 is not stack'd, malloc'd or (recently) free'd
Finally, here's my compiler/linker commands:
gcc -g -D_GNU_SOURCE -Iinclude -I/usr/local/include/php -I/usr/local/include/php/Zend -I/usr/local/include/php/include -I/usr/local/include/php/main -I/usr/local/include/php/ext -I/usr/local/include/php/sapi -I/usr/local/include/php/TSRM -c /path/to/parser.c -o obj/Debug/include/parser.o
g++ -Linclude -L/usr/lib/x86_64-linux-gnu -L/usr/local/lib -o bin/Debug/parse-script obj/Debug/include/parser.o obj/Debug/include/project.o obj/Debug/include/utils.o obj/Debug/parse-script-main.o -lphp7 -ldl -lc -lpthread -lgcc
I know the generated object files don't match the code above. I wrapped my problem function in "int main(void)" in the examples above.

Answer 1

Okay, I managed to get past this. I'll post my findings here. Basically, most of the information you find when you search on this topic (at least for me) is related to writing PHP extensions, not linking PHP into your c app and calling some of its internal functions. Here's what is currently working for me:
main.c:
#include <stdio.h>
#include <stdlib.h>
#include <sapi/embed/php_embed.h>
#include "parser.h"
int main(int, char *[]);
int main(int argc, char *argv[])
{
if (argc != 2) {
fprintf(stdout, "USAGE: parse-script <php-file>\n");
exit(0);
}
PHP_EMBED_START_BLOCK(argc, argv);
parse_php_file(argv[1]);
PHP_EMBED_END_BLOCK();
return 0;
}
parser.c:
#include <stdio.h>
#include "utils.h"
#include "php.h"
int parse_php(char *code)
{
zval function_name;
zval return_value;
int param_count = 1;
zval code_param;
zval *params[1];
ZVAL_STRINGL(params[0], code, strlen(code), 0);
INIT_ZVAL(function_name);
ZVAL_STRING(&function_name, "token_get_all", 0);
TSRMLS_FETCH();
if (call_user_function(CG(function_table), (zval **)NULL, &function_name, &return_value, 1, params TSRMLS_CC) == SUCCESS) {
zend_print_zval_r(&return_value, 0);
} else {
fprintf(stderr, "Error parsing PHP code.\n");
}
printf("Done\n");
}
int parse_php_file(char *file_name)
{
char *code;
code = read_file(file_name);
if (code == NULL) {
fprintf(stderr, "Could not read file: %s\n", file_name);
return 0;
}
parse_php(code);
}
The key seems to be the PHP_EMBED_START_BLOCK() and PHP_EMBED_END_BLOCK(). Wrapping my main code in those two statements made everything start working properly. Hopefully this will save someone some headaches down the road :)