archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Avoid large eval inputs in fuzzer

Browse source 
While we limit the size of the main compilation input, the size
of eval inputs was not limited. This could result in stack
overflows, e.g. oss-fuzz #25464.
This commit is contained in:
Nikita Popov 2020-09-07 11:53:01 +02:00
parent f5dbebd82e
commit 9475bcbef7
1 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

19
sapi/fuzzer/fuzzer-execute.c
View file

@ -20,13 +20,14 @@
#include "fuzzer-sapi.h"
#define MAX_STEPS 1000
#define MAX_SIZE (16 * 1024)
static uint32_t steps_left;
/* Because the fuzzer is always compiled with clang,
* we can assume that we don't use global registers / hybrid VM. */
typedef int (ZEND_FASTCALL *opcode_handler_t)(zend_execute_data *);
void fuzzer_execute_ex(zend_execute_data *execute_data) {
static void fuzzer_execute_ex(zend_execute_data *execute_data) {
while (1) {
int ret;
if (--steps_left == 0) {
@ -46,8 +47,19 @@ void fuzzer_execute_ex(zend_execute_data *execute_data) {
}
}
static zend_op_array *(*orig_compile_string)(zend_string *source_string, const char *filename);
static zend_op_array *fuzzer_compile_string(zend_string *str, const char *filename) {
if (ZSTR_LEN(str) > MAX_SIZE) {
/* Avoid compiling huge inputs via eval(). */
zend_bailout();
}
return orig_compile_string(str, filename);
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (Size > 16 * 1024) {
if (Size > MAX_SIZE) {
/* Large inputs have a large impact on fuzzer performance,
* but are unlikely to be necessary to reach new codepaths. */
return 0;
@ -68,7 +80,10 @@ int LLVMFuzzerInitialize(int *argc, char ***argv) {
signal(SIGPIPE, SIG_IGN);
fuzzer_init_php();
zend_execute_ex = fuzzer_execute_ex;
orig_compile_string = zend_compile_string;
zend_compile_string = fuzzer_compile_string;
/* fuzzer_shutdown_php(); */
return 0;