diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-06-30 15:05:02 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-06-30 15:05:02 +0200 |
| commit | b0b836175c08f84aba7a44909f9299694a3b4276 (patch) | |
| tree | 73918226be22789569f71ceed04671770d01ac4d /sapi/fuzzer/fuzzer-unserialize.c | |
| parent | 75ada661b9264eb55587ccbfa3bcd7447c5163f3 (diff) | |
| download | php-git-b0b836175c08f84aba7a44909f9299694a3b4276.tar.gz | |
Extract some common fuzzer code
Diffstat (limited to 'sapi/fuzzer/fuzzer-unserialize.c')
| -rw-r--r-- | sapi/fuzzer/fuzzer-unserialize.c | 29 |
1 files changed, 3 insertions, 26 deletions
diff --git a/sapi/fuzzer/fuzzer-unserialize.c b/sapi/fuzzer/fuzzer-unserialize.c index 4b65197df9..ff68ee6e3e 100644 --- a/sapi/fuzzer/fuzzer-unserialize.c +++ b/sapi/fuzzer/fuzzer-unserialize.c @@ -31,26 +31,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { unsigned char *orig_data = malloc(Size+1); - zend_execute_data execute_data; - zend_function func; - memcpy(orig_data, Data, Size); orig_data[Size] = '\0'; - if (fuzzer_request_startup()==FAILURE) { + if (fuzzer_request_startup() == FAILURE) { return 0; } - /* Set up a dummy stack frame so that exceptions may be thrown. */ - { - memset(&execute_data, 0, sizeof(zend_execute_data)); - memset(&func, 0, sizeof(zend_function)); - - func.type = ZEND_INTERNAL_FUNCTION; - func.common.function_name = ZSTR_EMPTY_ALLOC(); - execute_data.func = &func; - EG(current_execute_data) = &execute_data; - } + fuzzer_setup_dummy_frame(); { const unsigned char *data = orig_data; @@ -63,22 +51,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { PHP_VAR_UNSERIALIZE_DESTROY(var_hash); zval_ptr_dtor(&result); - - /* Destroy any thrown exception. */ - if (EG(exception)) { - zend_object_release(EG(exception)); - EG(exception) = NULL; - } } - /* Unserialize may create circular structure. Make sure we free them. - * Two calls are performed to handle objects with destructors. */ - zend_gc_collect_cycles(); - zend_gc_collect_cycles(); - php_request_shutdown(NULL); - free(orig_data); + fuzzer_request_shutdown(); return 0; } |
