3v4l.org

run code in 500+ PHP versions simultaneously
<?php $cwd = sys_get_temp_dir() . '/php-src-proc-open-nul-poc'; @mkdir($cwd); $proc = proc_open( [PHP_BINARY, '-r', 'echo getcwd(), PHP_EOL;'], [1 => ['pipe', 'w']], $pipes, $cwd . "\0/ignored" ); echo stream_get_contents($pipes[1]); proc_close($proc);
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/o56Sq
function name:  (null)
number of ops:  26
compiled vars:  !0 = $cwd, !1 = $proc, !2 = $pipes
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    2     0  E >   INIT_FCALL                                                   'sys_get_temp_dir'
          1        DO_ICALL                                             $3      
          2        CONCAT                                               ~4      $3, '%2Fphp-src-proc-open-nul-poc'
          3        ASSIGN                                                       !0, ~4
    3     4        BEGIN_SILENCE                                        ~6      
          5        INIT_FCALL                                                   'mkdir'
          6        SEND_VAR                                                     !0
          7        DO_ICALL                                                     
          8        END_SILENCE                                                  ~6
    5     9        INIT_FCALL                                                   'proc_open'
    6    10        SEND_VAL                                                     <array>
    7    11        SEND_VAL                                                     <array>
    8    12        SEND_REF                                                     !2
    9    13        CONCAT                                               ~8      !0, '%00%2Fignored'
         14        SEND_VAL                                                     ~8
    5    15        DO_ICALL                                             $9      
         16        ASSIGN                                                       !1, $9
   12    17        INIT_FCALL                                                   'stream_get_contents'
         18        FETCH_DIM_R                                          ~11     !2, 1
         19        SEND_VAL                                                     ~11
         20        DO_ICALL                                             $12     
         21        ECHO                                                         $12
   13    22        INIT_FCALL                                                   'proc_close'
         23        SEND_VAR                                                     !1
         24        DO_ICALL                                                     
         25      > RETURN                                                       1

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
169.47 ms | 1323 KiB | 18 Q