Coverage Report

Created: 2026-10-28 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/sapi/fuzzer/fuzzer-function-jit.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright © The PHP Group and Contributors.                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to the Modified BSD License that is      |
6
   | bundled with this package in the file LICENSE, and is available      |
7
   | through the World Wide Web at <https://www.php.net/license/>.        |
8
   |                                                                      |
9
   | SPDX-License-Identifier: BSD-3-Clause                                |
10
   +----------------------------------------------------------------------+
11
   | Authors: Nikita Popov <nikic@php.net>                                |
12
   +----------------------------------------------------------------------+
13
 */
14
15
#include "fuzzer-execute-common.h"
16
17
22.8k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
18
22.8k
  if (Size > MAX_SIZE) {
19
    /* Large inputs have a large impact on fuzzer performance,
20
     * but are unlikely to be necessary to reach new codepaths. */
21
7
    return 0;
22
7
  }
23
24
22.8k
  zend_string *jit_option = ZSTR_INIT_LITERAL("opcache.jit", 1);
25
26
  /* First run without JIT to determine whether we bail out. We should not run JITed code if
27
   * we bail out here, as the JIT code may loop infinitely. */
28
22.8k
  steps_left = MAX_STEPS;
29
22.8k
  bailed_out = false;
30
22.8k
  set_jit_option(jit_option, "off");
31
22.8k
  fuzzer_do_request_from_buffer(
32
22.8k
    FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
33
34
22.8k
  if (!bailed_out) {
35
22.1k
    steps_left = MAX_STEPS;
36
22.1k
    set_jit_option(jit_option, "function");
37
22.1k
    zend_execute_ex = orig_execute_ex;
38
22.1k
    fuzzer_do_request_from_buffer(
39
22.1k
      FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
40
22.1k
    zend_execute_ex = fuzzer_execute_ex;
41
22.1k
  }
42
43
22.8k
  zend_string_release(jit_option);
44
45
22.8k
  return 0;
46
22.8k
}
47
48
16
int LLVMFuzzerInitialize(int *argc, char ***argv) {
49
16
  char ini_buf[512];
50
16
  snprintf(ini_buf, sizeof(ini_buf),
51
    /* The default opcache.jit=disable does not allow enabling the JIT at runtime. */
52
16
    "opcache.jit=off\n"
53
16
    "opcache.validate_timestamps=0\n"
54
16
    "opcache.file_update_protection=0\n"
55
16
    "opcache.jit_buffer_size=128M\n"
56
16
    "opcache.protect_memory=1\n");
57
58
16
  create_file();
59
16
  fuzzer_init_php_for_execute(ini_buf);
60
16
  return 0;
61
16
}