Coverage Report

Created: 2026-10-28 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/sapi/fuzzer/fuzzer-json.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Copyright © The PHP Group and Contributors.                          |
4
   +----------------------------------------------------------------------+
5
   | This source file is subject to the Modified BSD License that is      |
6
   | bundled with this package in the file LICENSE, and is available      |
7
   | through the World Wide Web at <https://www.php.net/license/>.        |
8
   |                                                                      |
9
   | SPDX-License-Identifier: BSD-3-Clause                                |
10
   +----------------------------------------------------------------------+
11
   | Authors: Johannes Schlüter <johanes@php.net>                         |
12
   |          Stanislav Malyshev <stas@php.net>                           |
13
   +----------------------------------------------------------------------+
14
 */
15
16
#include "fuzzer.h"
17
18
#include "Zend/zend.h"
19
#include <main/php_config.h>
20
#include "main/php_main.h"
21
22
#include <stdio.h>
23
#include <stdint.h>
24
#include <stdlib.h>
25
26
#include "fuzzer-sapi.h"
27
#include "ext/json/php_json.h"
28
#include "ext/json/php_json_parser.h"
29
30
7.79k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
31
32
7.79k
  if (fuzzer_request_startup() == FAILURE){
33
0
    return 0;
34
0
  }
35
36
7.79k
  char *data = malloc(Size + 1);
37
7.79k
  memcpy(data, Data, Size);
38
7.79k
  data[Size] = '\0';
39
40
7.79k
  int options[12] = {
41
7.79k
    0,
42
7.79k
    PHP_JSON_OBJECT_AS_ARRAY,
43
7.79k
    PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING,
44
7.79k
    PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
45
7.79k
    PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
46
7.79k
    PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_IGNORE,
47
7.79k
    PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
48
7.79k
    PHP_JSON_BIGINT_AS_STRING,
49
7.79k
    PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
50
7.79k
    PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
51
7.79k
    PHP_JSON_INVALID_UTF8_IGNORE,
52
7.79k
    PHP_JSON_INVALID_UTF8_SUBSTITUTE
53
7.79k
  };
54
55
101k
  for (int index = 0; index < 12; ++index) {
56
93.5k
    zval result;
57
93.5k
    php_json_parser parser;
58
93.5k
    php_json_parser_init(&parser, &result, data, Size, options[index], 10);
59
93.5k
    if (php_json_yyparse(&parser) == SUCCESS) {
60
24.3k
      zval_ptr_dtor(&result);
61
24.3k
    }
62
93.5k
  }
63
64
7.79k
  php_request_shutdown(NULL);
65
66
7.79k
  free(data);
67
7.79k
  return 0;
68
7.79k
}
69
70
16
int LLVMFuzzerInitialize(int *argc, char ***argv) {
71
16
  fuzzer_init_php(NULL);
72
73
  /* fuzzer_shutdown_php(); */
74
16
  return 0;
75
16
}