Add fuzzer SAPIs to the core
Stanislav Malyshev
Nikita Popov
18
sapi/fuzzer/Makefile.frag
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
fuzzer: $(PHP_FUZZER_BINARIES)
|
||||
|
||||
FUZZER_BUILD = $(LIBTOOL) --mode=link $(FUZZING_CC) -export-dynamic $(CFLAGS_CLEAN) $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS_PROGRAM) $(LDFLAGS) $(PHP_RPATHS) $(PHP_GLOBAL_OBJS) $(PHP_BINARY_OBJS) $(EXTRA_LIBS) $(ZEND_EXTRA_LIBS) $(FUZZING_LIB) -rpath /ORIGIN/lib
|
||||
|
||||
$(SAPI_FUZZER_PATH)/php-fuzz-parser: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_PARSER_OBJS)
|
||||
$(FUZZER_BUILD) $(PHP_FUZZER_PARSER_OBJS) -o $@
|
||||
|
||||
$(SAPI_FUZZER_PATH)/php-fuzz-unserialize: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_UNSERIALIZE_OBJS)
|
||||
$(FUZZER_BUILD) $(PHP_FUZZER_UNSERIALIZE_OBJS) -o $@
|
||||
|
||||
$(SAPI_FUZZER_PATH)/php-fuzz-json: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_JSON_OBJS)
|
||||
$(FUZZER_BUILD) $(PHP_FUZZER_JSON_OBJS) -o $@
|
||||
|
||||
$(SAPI_FUZZER_PATH)/php-fuzz-exif: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_EXIF_OBJS)
|
||||
$(FUZZER_BUILD) $(PHP_FUZZER_EXIF_OBJS) -o $@
|
||||
|
||||
$(SAPI_FUZZER_PATH)/php-fuzz-mbstring: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_MBSTRING_OBJS)
|
||||
$(FUZZER_BUILD) $(PHP_FUZZER_MBSTRING_OBJS) -o $@
|
||||
13
sapi/fuzzer/README
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
Fuzzing SAPI for PHP
|
||||
|
||||
Enable fuzzing targets with --enable-fuzzer switch.
|
||||
|
||||
Your compiler should support -fsanitize=address and you need
|
||||
to have Fuzzer library around.
|
||||
|
||||
When running `make` it creates these binaries in `sapi/fuzzer/`:
|
||||
* php-fuzz-parser - fuzzing language parser
|
||||
* php-fuzz-unserialize - fuzzing unserialize() function
|
||||
* php-fuzz-json - fuzzing JSON parser
|
||||
* php-fuzz-exif - fuzzing exif_read_data() function (use --enable-exif)
|
||||
* php-fuzz-mbstring - fuzzing mb_ereg[i] (requires --enable-mbstring)
|
||||
63
sapi/fuzzer/config.m4
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
AC_MSG_CHECKING(for clang fuzzer SAPI)
|
||||
|
||||
PHP_ARG_ENABLE([fuzzer],,
|
||||
[AS_HELP_STRING([--enable-fuzzer],
|
||||
[Build PHP as clang fuzzing test module (for developers)])],
|
||||
[no])
|
||||
|
||||
dnl For newer clang versions see https://llvm.org/docs/LibFuzzer.html#fuzzer-usage
|
||||
dnl for relevant flags.
|
||||
|
||||
dnl Macro to define fuzzing target
|
||||
dnl PHP_FUZZER_TARGET(name, target-var)
|
||||
dnl
|
||||
AC_DEFUN([PHP_FUZZER_TARGET], [
|
||||
PHP_FUZZER_BINARIES="$PHP_FUZZER_BINARIES $SAPI_FUZZER_PATH/php-fuzz-$1"
|
||||
PHP_SUBST($2)
|
||||
PHP_ADD_SOURCES_X([sapi/fuzzer],[fuzzer-$1.c fuzzer-sapi.c],[],$2)
|
||||
])
|
||||
|
||||
if test "$PHP_FUZZER" != "no"; then
|
||||
AC_MSG_RESULT([yes])
|
||||
PHP_REQUIRE_CXX()
|
||||
PHP_ADD_MAKEFILE_FRAGMENT($abs_srcdir/sapi/fuzzer/Makefile.frag)
|
||||
SAPI_FUZZER_PATH=sapi/fuzzer
|
||||
PHP_SUBST(SAPI_FUZZER_PATH)
|
||||
if test -z "$LIB_FUZZING_ENGINE"; then
|
||||
FUZZING_LIB="-lFuzzer"
|
||||
FUZZING_CC="$CC"
|
||||
AX_CHECK_COMPILE_FLAG([-fsanitize=address], [
|
||||
CFLAGS="$CFLAGS -fsanitize=address"
|
||||
CXXFLAGS="$CXXFLAGS -fsanitize=address"
|
||||
LDFLAGS="$LDFLAGS -fsanitize=address"
|
||||
],[
|
||||
AC_MSG_ERROR(compiler doesn't support -fsanitize flags)
|
||||
])
|
||||
else
|
||||
FUZZING_LIB="-lFuzzingEngine"
|
||||
FUZZING_CC="$CXX -stdlib=libc++"
|
||||
fi
|
||||
PHP_SUBST(FUZZING_LIB)
|
||||
PHP_SUBST(FUZZING_CC)
|
||||
|
||||
dnl PHP_SELECT_SAPI(fuzzer-parser, program, $FUZZER_SOURCES, , '$(SAPI_FUZZER_PATH)')
|
||||
|
||||
PHP_ADD_BUILD_DIR([sapi/fuzzer])
|
||||
PHP_FUZZER_BINARIES=""
|
||||
PHP_INSTALLED_SAPIS="$PHP_INSTALLED_SAPIS fuzzer"
|
||||
|
||||
PHP_FUZZER_TARGET([parser], PHP_FUZZER_PARSER_OBJS)
|
||||
PHP_FUZZER_TARGET([unserialize], PHP_FUZZER_UNSERIALIZE_OBJS)
|
||||
PHP_FUZZER_TARGET([exif], PHP_FUZZER_EXIF_OBJS)
|
||||
|
||||
if test -n "$enable_json" && test "$enable_json" != "no"; then
|
||||
PHP_FUZZER_TARGET([json], PHP_FUZZER_JSON_OBJS)
|
||||
fi
|
||||
if test -n "$enable_mbstring" && test "$enable_mbstring" != "no"; then
|
||||
PHP_FUZZER_TARGET([mbstring], PHP_FUZZER_MBSTRING_OBJS)
|
||||
fi
|
||||
|
||||
PHP_SUBST(PHP_FUZZER_BINARIES)
|
||||
fi
|
||||
|
||||
AC_MSG_RESULT($PHP_FUZZER)
|
||||
BIN
sapi/fuzzer/corpus/exif/bug34704.jpg
Normal file
|
After Width: | Height: | Size: 9.7 KiB |
BIN
sapi/fuzzer/corpus/exif/bug34704_2.jpg
Normal file
|
After Width: | Height: | Size: 9.7 KiB |
BIN
sapi/fuzzer/corpus/exif/bug48378.jpeg
Normal file
|
After Width: | Height: | Size: 2.5 KiB |
BIN
sapi/fuzzer/corpus/exif/bug54002_1.jpeg
Normal file
|
After Width: | Height: | Size: 86 KiB |
BIN
sapi/fuzzer/corpus/exif/bug54002_2.jpeg
Normal file
|
After Width: | Height: | Size: 86 KiB |
9
sapi/fuzzer/corpus/exif/bug62523_1.jpg
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
|
||||
<html><head>
|
||||
<title>301 Moved Permanently</title>
|
||||
</head><body>
|
||||
<h1>Moved Permanently</h1>
|
||||
<p>The document has moved <a href="http://www.getid3.org/temp/62523.jpg">here</a>.</p>
|
||||
<hr>
|
||||
<address>Apache Server at getid3.org Port 80</address>
|
||||
</body></html>
|
||||
12
sapi/fuzzer/corpus/exif/bug62523_3.jpg
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
<html>
|
||||
<head><title>Found</title></head>
|
||||
<body>
|
||||
<h1>Found</h1>
|
||||
<p>The resource was found at <a href="http://dl.dropboxusercontent.com/u/7562584/Bugs/Php/bad_exif.jpeg">http://dl.dropboxusercontent.com/u/7562584/Bugs/Php/bad_exif.jpeg</a>;
|
||||
you should be redirected automatically.
|
||||
|
||||
<!-- --></p>
|
||||
<hr noshade>
|
||||
<div align="right">WSGI Server</div>
|
||||
</body>
|
||||
</html>
|
||||
BIN
sapi/fuzzer/corpus/exif/bug68113.jpg
Normal file
|
After Width: | Height: | Size: 368 B |
BIN
sapi/fuzzer/corpus/exif/bug68113_2.jpg
Normal file
|
After Width: | Height: | Size: 368 B |
BIN
sapi/fuzzer/corpus/exif/bug68799.jpg
Normal file
|
After Width: | Height: | Size: 735 B |
BIN
sapi/fuzzer/corpus/exif/bug72094_1.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug72094_2.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug72094_3.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug72094_4.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug72603.jpeg
Normal file
|
After Width: | Height: | Size: 3.6 KiB |
BIN
sapi/fuzzer/corpus/exif/bug72618.jpg
Normal file
|
After Width: | Height: | Size: 3.6 KiB |
BIN
sapi/fuzzer/corpus/exif/bug72627.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/bug73737.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/bug76130_1.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug76130_2.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug76423.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug76557.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77540.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77563.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77753.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77831.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77950.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/bug77988.jpg
Normal file
BIN
sapi/fuzzer/corpus/exif/exif_encoding_crash.jpg
Normal file
|
After Width: | Height: | Size: 7.4 KiB |
BIN
sapi/fuzzer/corpus/exif/image007.jpg
Normal file
|
After Width: | Height: | Size: 283 B |
BIN
sapi/fuzzer/corpus/exif/image008.jpg
Normal file
|
After Width: | Height: | Size: 527 B |
BIN
sapi/fuzzer/corpus/exif/image009.jpg
Normal file
|
After Width: | Height: | Size: 527 B |
BIN
sapi/fuzzer/corpus/exif/image010.jpg
Normal file
|
After Width: | Height: | Size: 741 B |
BIN
sapi/fuzzer/corpus/exif/image011.jpg
Normal file
|
After Width: | Height: | Size: 741 B |
BIN
sapi/fuzzer/corpus/exif/image012.jpg
Normal file
|
After Width: | Height: | Size: 721 B |
BIN
sapi/fuzzer/corpus/exif/image013.jpg
Normal file
|
After Width: | Height: | Size: 721 B |
BIN
sapi/fuzzer/corpus/exif/image014.jpg
Normal file
|
After Width: | Height: | Size: 935 B |
BIN
sapi/fuzzer/corpus/exif/image015.jpg
Normal file
|
After Width: | Height: | Size: 935 B |
BIN
sapi/fuzzer/corpus/exif/image016.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image017.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image018.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image020.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image021.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image022.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image023.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image024.jpg
Normal file
|
After Width: | Height: | Size: 417 B |
BIN
sapi/fuzzer/corpus/exif/image025.jpg
Normal file
|
After Width: | Height: | Size: 417 B |
BIN
sapi/fuzzer/corpus/exif/image026.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/image027.tiff
Normal file
BIN
sapi/fuzzer/corpus/exif/test1.jpg
Normal file
|
After Width: | Height: | Size: 523 B |
BIN
sapi/fuzzer/corpus/exif/test2.jpg
Normal file
|
After Width: | Height: | Size: 1.2 KiB |
BIN
sapi/fuzzer/corpus/exif/test22.jpg
Normal file
|
After Width: | Height: | Size: 1.2 KiB |
BIN
sapi/fuzzer/corpus/exif/test3.jpg
Normal file
|
After Width: | Height: | Size: 1.2 KiB |
BIN
sapi/fuzzer/corpus/exif/test4.jpg
Normal file
|
After Width: | Height: | Size: 713 B |
BIN
sapi/fuzzer/corpus/exif/test5.jpg
Normal file
|
After Width: | Height: | Size: 603 B |
BIN
sapi/fuzzer/corpus/exif/test6.jpg
Normal file
|
After Width: | Height: | Size: 1.2 KiB |
1
sapi/fuzzer/corpus/json/1.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"prop":{"prop":null}}
|
||||
1
sapi/fuzzer/corpus/json/10.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"a":100.1,"b":"foo"}
|
||||
1
sapi/fuzzer/corpus/json/11.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[100.1,"bar"]
|
||||
2
sapi/fuzzer/corpus/json/12.json
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
{"0":0,"\u0000ab":1,"1":"\u0000null-prefixed value"}
|
||||
|
||||
1
sapi/fuzzer/corpus/json/13.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{ "test": { "foo": "bar" } }
|
||||
2
sapi/fuzzer/corpus/json/14.json
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
"aa\udbff\udffdzz"
|
||||
|
||||
1
sapi/fuzzer/corpus/json/15.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
"latin 1234 -\/ russian мама мыла раму specialchars \u0002 \b \n U+1D11E >𝄞<"
|
||||
1
sapi/fuzzer/corpus/json/16.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"test":"123343e871700"}
|
||||
1
sapi/fuzzer/corpus/json/17.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[["Too deep"]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
|
||||
1
sapi/fuzzer/corpus/json/18.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"myInt":99,"myFloat":123.45,"myNull":null,"myBool":true,"myString":"Hello World"}
|
||||
1
sapi/fuzzer/corpus/json/19.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
"\u65e5\u672c\u8a9e\u30c6\u30ad\u30b9\u30c8\u3067\u3059\u300201234\uff15\uff16\uff17\uff18\uff19\u3002"
|
||||
1
sapi/fuzzer/corpus/json/2.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"largenum":123456789012345678901234567890}
|
||||
1
sapi/fuzzer/corpus/json/3.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["<foo>","'bar'","\"baz\"","&blong&"]
|
||||
1
sapi/fuzzer/corpus/json/4.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["\u003Cfoo\u003E","\u0027bar\u0027","\u0022baz\u0022","\u0026blong\u0026"]
|
||||
5
sapi/fuzzer/corpus/json/5.json
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
[
|
||||
{"":"value"},
|
||||
{"":"value", "key":"value"},
|
||||
{"key":"value", "":"value"}
|
||||
]
|
||||
1
sapi/fuzzer/corpus/json/6.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[123,13452345,123.13452345]
|
||||
2
sapi/fuzzer/corpus/json/7.json
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
["\ud834\udd00"]
|
||||
|
||||
1
sapi/fuzzer/corpus/json/8.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"zero": 0e0}
|
||||
1
sapi/fuzzer/corpus/json/9.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[null,null,"abc"]
|
||||
1
sapi/fuzzer/corpus/json/fail1.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
"A JSON payload should be an object or array, not a string."
|
||||
1
sapi/fuzzer/corpus/json/fail10.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Extra value after close": true} "misplaced quoted value"
|
||||
1
sapi/fuzzer/corpus/json/fail11.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Illegal expression": 1 + 2}
|
||||
1
sapi/fuzzer/corpus/json/fail12.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Illegal invocation": alert()}
|
||||
1
sapi/fuzzer/corpus/json/fail13.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Numbers cannot have leading zeroes": 013}
|
||||
1
sapi/fuzzer/corpus/json/fail14.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Numbers cannot be hex": 0x14}
|
||||
1
sapi/fuzzer/corpus/json/fail15.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["Illegal backslash escape: \x15"]
|
||||
1
sapi/fuzzer/corpus/json/fail16.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[\naked]
|
||||
1
sapi/fuzzer/corpus/json/fail17.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["Illegal backslash escape: \017"]
|
||||
1
sapi/fuzzer/corpus/json/fail18.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[[[[[[[[[[[[[[[[[[[["Too deep"]]]]]]]]]]]]]]]]]]]]
|
||||
1
sapi/fuzzer/corpus/json/fail19.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Missing colon" null}
|
||||
1
sapi/fuzzer/corpus/json/fail2.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["Unclosed array"
|
||||
1
sapi/fuzzer/corpus/json/fail20.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Double colon":: null}
|
||||
1
sapi/fuzzer/corpus/json/fail21.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"Comma instead of colon", null}
|
||||
1
sapi/fuzzer/corpus/json/fail22.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["Colon instead of comma": false]
|
||||
1
sapi/fuzzer/corpus/json/fail23.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["Bad value", truth]
|
||||
1
sapi/fuzzer/corpus/json/fail24.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
['single quote']
|
||||
1
sapi/fuzzer/corpus/json/fail25.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[" tab character in string "]
|
||||
1
sapi/fuzzer/corpus/json/fail26.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
["tab\ character\ in\ string\ "]
|
||||
2
sapi/fuzzer/corpus/json/fail27.json
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
["line
|
||||
break"]
|
||||
2
sapi/fuzzer/corpus/json/fail28.json
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
["line\
|
||||
break"]
|
||||
1
sapi/fuzzer/corpus/json/fail29.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
[0e]
|
||||