Coverage Report

Created: 2022-10-14 11:20

/src/php-src/sapi/fuzzer/fuzzer-parser.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright (c) The PHP Group                                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to version 3.01 of the PHP license,      |
6
   | that is bundled with this package in the file LICENSE, and is        |
7
   | available through the world-wide-web at the following url:           |
8
   | http://www.php.net/license/3_01.txt                                  |
9
   | If you did not receive a copy of the PHP license and are unable to   |
10
   | obtain it through the world-wide-web, please send a note to          |
11
   | license@php.net so we can mail you a copy immediately.               |
12
   +----------------------------------------------------------------------+
13
   | Authors: Johannes Schlüter <johanes@php.net>                         |
14
   |          Stanislav Malyshev <stas@php.net>                           |
15
   +----------------------------------------------------------------------+
16
 */
17
18
#include <main/php.h>
19
#include <main/php_main.h>
20
#include <main/SAPI.h>
21
#include <ext/standard/info.h>
22
#include <ext/standard/php_var.h>
23
#include <main/php_variables.h>
24
25
#include "fuzzer.h"
26
#include "fuzzer-sapi.h"
27
28
386k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
29
386k
  char *s;
30
386k
  if (Size > 32 * 1024) {
31
    /* Large inputs have a large impact on fuzzer performance,
32
     * but are unlikely to be necessary to reach new codepaths. */
33
3.31k
    return 0;
34
3.31k
  }
35
36
383k
  s = malloc(Size+1);
37
383k
  memcpy(s, Data, Size);
38
383k
  s[Size] = '\0';
39
40
383k
  fuzzer_do_request_from_buffer("fuzzer.php", s, Size);
41
42
  /* Do not free s: fuzzer_do_request_from_buffer() takes ownership of the allocation. */
43
383k
  return 0;
44
383k
}
45
46
3.54k
int LLVMFuzzerInitialize(int *argc, char ***argv) {
47
  /* Compilation will often trigger fatal errors.
48
   * Use tracked allocation mode to avoid leaks in that case. */
49
3.54k
  putenv("USE_TRACKED_ALLOC=1");
50
51
3.54k
  fuzzer_init_php();
52
53
  /* fuzzer_shutdown_php(); */
54
3.54k
  return 0;
55
3.54k
}