/src/php-src/sapi/fuzzer/fuzzer-json.c
Line | Count | Source |
1 | | /* |
2 | | +----------------------------------------------------------------------+ |
3 | | | Copyright © The PHP Group and Contributors. | |
4 | | +----------------------------------------------------------------------+ |
5 | | | This source file is subject to the Modified BSD License that is | |
6 | | | bundled with this package in the file LICENSE, and is available | |
7 | | | through the World Wide Web at <https://www.php.net/license/>. | |
8 | | | | |
9 | | | SPDX-License-Identifier: BSD-3-Clause | |
10 | | +----------------------------------------------------------------------+ |
11 | | | Authors: Johannes Schlüter <johanes@php.net> | |
12 | | | Stanislav Malyshev <stas@php.net> | |
13 | | +----------------------------------------------------------------------+ |
14 | | */ |
15 | | |
16 | | #include "fuzzer.h" |
17 | | |
18 | | #include "Zend/zend.h" |
19 | | #include <main/php_config.h> |
20 | | #include "main/php_main.h" |
21 | | |
22 | | #include <stdio.h> |
23 | | #include <stdint.h> |
24 | | #include <stdlib.h> |
25 | | |
26 | | #include "fuzzer-sapi.h" |
27 | | #include "ext/json/php_json.h" |
28 | | #include "ext/json/php_json_parser.h" |
29 | | |
30 | 7.79k | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { |
31 | | |
32 | 7.79k | if (fuzzer_request_startup() == FAILURE){ |
33 | 0 | return 0; |
34 | 0 | } |
35 | | |
36 | 7.79k | char *data = malloc(Size + 1); |
37 | 7.79k | memcpy(data, Data, Size); |
38 | 7.79k | data[Size] = '\0'; |
39 | | |
40 | 7.79k | int options[12] = { |
41 | 7.79k | 0, |
42 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY, |
43 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING, |
44 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE, |
45 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE, |
46 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_IGNORE, |
47 | 7.79k | PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_SUBSTITUTE, |
48 | 7.79k | PHP_JSON_BIGINT_AS_STRING, |
49 | 7.79k | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE, |
50 | 7.79k | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE, |
51 | 7.79k | PHP_JSON_INVALID_UTF8_IGNORE, |
52 | 7.79k | PHP_JSON_INVALID_UTF8_SUBSTITUTE |
53 | 7.79k | }; |
54 | | |
55 | 101k | for (int index = 0; index < 12; ++index) { |
56 | 93.5k | zval result; |
57 | 93.5k | php_json_parser parser; |
58 | 93.5k | php_json_parser_init(&parser, &result, data, Size, options[index], 10); |
59 | 93.5k | if (php_json_yyparse(&parser) == SUCCESS) { |
60 | 24.3k | zval_ptr_dtor(&result); |
61 | 24.3k | } |
62 | 93.5k | } |
63 | | |
64 | 7.79k | php_request_shutdown(NULL); |
65 | | |
66 | 7.79k | free(data); |
67 | 7.79k | return 0; |
68 | 7.79k | } |
69 | | |
70 | 16 | int LLVMFuzzerInitialize(int *argc, char ***argv) { |
71 | 16 | fuzzer_init_php(NULL); |
72 | | |
73 | | /* fuzzer_shutdown_php(); */ |
74 | 16 | return 0; |
75 | 16 | } |