archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Disable destructors on fuzzer bailout

Browse source 
This is what we normally do for fatal errors. The reason why this
became necessary now, is that a bailout can switch from a fiber
back to the main stack. In that case we do not want to try
destroying the fiber.

Fixes oss-fuzz #33917.
This commit is contained in:
Nikita Popov 2021-05-06 18:40:47 +02:00
parent e5b6f43ec7
commit ed33262dbb
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
sapi/fuzzer/fuzzer-execute.c
View file

@ -27,6 +27,14 @@ static uint32_t steps_left;
* we can assume that we don't use global registers / hybrid VM. */
typedef int (ZEND_FASTCALL *opcode_handler_t)(zend_execute_data *);
static ZEND_NORETURN void fuzzer_bailout() {
/* Disable object destructors, like we would do for fatal errors. In particular, if we
* perform a bailout from a fiber to the main stack, we should not try to destroy the
* fiber. */
zend_objects_store_mark_destructed(&EG(objects_store));
zend_bailout();
}
static void fuzzer_execute_ex(zend_execute_data *execute_data) {
while (1) {
int ret;
@ -34,7 +42,7 @@ static void fuzzer_execute_ex(zend_execute_data *execute_data) {
/* Reset steps before bailing out, so code running after bailout (e.g. in
* destructors) will get another MAX_STEPS, rather than UINT32_MAX steps. */
steps_left = MAX_STEPS;
zend_bailout();
fuzzer_bailout();
}
if ((ret = ((opcode_handler_t) EX(opline)->handler)(execute_data)) != 0) {
@ -52,7 +60,7 @@ static zend_op_array *(*orig_compile_string)(zend_string *source_string, const c
static zend_op_array *fuzzer_compile_string(zend_string *str, const char *filename) {
if (ZSTR_LEN(str) > MAX_SIZE) {
/* Avoid compiling huge inputs via eval(). */
zend_bailout();
fuzzer_bailout();
}
return orig_compile_string(str, filename);