Coverage Report

Created: 2026-06-02 06:36

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/sapi/fuzzer/fuzzer-unserialize.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright © The PHP Group and Contributors.                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to the Modified BSD License that is      |
6
   | bundled with this package in the file LICENSE, and is available      |
7
   | through the World Wide Web at <https://www.php.net/license/>.        |
8
   |                                                                      |
9
   | SPDX-License-Identifier: BSD-3-Clause                                |
10
   +----------------------------------------------------------------------+
11
   | Authors: Johannes Schlüter <johanes@php.net>                         |
12
   +----------------------------------------------------------------------+
13
 */
14
15
16
#include "fuzzer.h"
17
18
#include "Zend/zend.h"
19
#include <main/php_config.h>
20
#include "main/php_main.h"
21
22
#include <stdio.h>
23
#include <stdint.h>
24
#include <stdlib.h>
25
26
#include "fuzzer-sapi.h"
27
28
#include "ext/standard/php_var.h"
29
30
38.2k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
31
32
38.2k
  if (fuzzer_request_startup() == FAILURE) {
33
0
    return 0;
34
0
  }
35
36
38.2k
  unsigned char *orig_data = malloc(Size+1);
37
38.2k
  memcpy(orig_data, Data, Size);
38
38.2k
  orig_data[Size] = '\0';
39
40
38.2k
  fuzzer_setup_dummy_frame();
41
42
38.2k
  {
43
38.2k
    const unsigned char *data = orig_data;
44
38.2k
    zval result;
45
38.2k
    ZVAL_UNDEF(&result);
46
47
38.2k
    php_unserialize_data_t var_hash;
48
38.2k
    PHP_VAR_UNSERIALIZE_INIT(var_hash);
49
38.2k
    php_var_unserialize(&result, (const unsigned char **) &data, data + Size, &var_hash);
50
38.2k
    PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
51
52
38.2k
    zval_ptr_dtor(&result);
53
38.2k
  }
54
55
38.2k
  free(orig_data);
56
57
38.2k
  fuzzer_request_shutdown();
58
38.2k
  return 0;
59
38.2k
}
60
61
2
int LLVMFuzzerInitialize(int *argc, char ***argv) {
62
2
  fuzzer_init_php(NULL);
63
64
  /* fuzzer_shutdown_php(); */
65
2
  return 0;
66
2
}