-
Notifications
You must be signed in to change notification settings - Fork 7.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Various improvements to fuzzer SAPIs
- Loading branch information
Showing
25 changed files
with
320 additions
and
100 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
Fuzzing SAPI for PHP | ||
-------------------- | ||
|
||
The following `./configure` options can be used to enable the fuzzing SAPI, as well as all availablefuzzers. If you don't build the exif/json/mbstring extensions, fuzzers for these extensions will not be built. | ||
|
||
```sh | ||
./configure \ | ||
--enable-fuzzer \ | ||
--with-pic \ | ||
--enable-debug-assertions \ | ||
--enable-exif \ | ||
--enable-json \ | ||
--enable-mbstring | ||
``` | ||
|
||
The `--with-pic` option is required to avoid a linking failure. The `--enable-debug-assertions` option can be used to enable debug assertions despite the use of a release build. | ||
|
||
You will need a recent version of clang that supports the `-fsanitize=fuzzer-no-link` option. | ||
|
||
When running `make` it creates these binaries in `sapi/fuzzer/`: | ||
|
||
* `php-fuzz-parser`: Fuzzing language parser and compiler | ||
* `php-fuzz-unserialize`: Fuzzing unserialize() function | ||
* `php-fuzz-json`: Fuzzing JSON parser (requires --enable-json) | ||
* `php-fuzz-exif`: Fuzzing `exif_read_data()` function (requires --enable-exif) | ||
* `php-fuzz-mbstring`: fuzzing `mb_ereg[i]()` (requires --enable-mbstring) | ||
|
||
Some fuzzers have a seed corpus in `sapi/fuzzer/corpus`. You can use it as follows: | ||
|
||
```sh | ||
cp -r sapi/fuzzer/corpus/exif ./my-exif-corpus | ||
sapi/fuzzer/php-fuzz-exif ./my-exif-corpus | ||
``` | ||
|
||
For the unserialize fuzzer, a dictionary of internal classes should be generated first: | ||
|
||
```sh | ||
sapi/cli/php sapi/fuzzer/corpus/generate_unserialize_dict.php | ||
cp -r sapi/fuzzer/corpus/unserialize ./my-unserialize-corpus | ||
sapi/fuzzer/php-fuzz-unserialize -dict=$PWD/sapi/fuzzer/corpus/unserialize.dict ./my-unserialize-corpus | ||
``` | ||
|
||
For the parser fuzzer, a corpus may be generated from Zend test files: | ||
|
||
```sh | ||
sapi/cli/php sapi/fuzzer/corpus/generate_parser_corpus.php | ||
mkdir ./my-parser-corpus | ||
sapi/fuzzer/php-fuzz-parser -merge=1 ./my-parser-corpus sapi/fuzzer/corpus/parser | ||
sapi/fuzzer/php-fuzz-parser -only_ascii=1 ./my-parser-corpus | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
<?php | ||
|
||
$testsDir = __DIR__ . '/../../../Zend/tests/'; | ||
$it = new RecursiveIteratorIterator( | ||
new RecursiveDirectoryIterator($testsDir), | ||
RecursiveIteratorIterator::LEAVES_ONLY | ||
); | ||
|
||
$corpusDir = __DIR__ . '/parser'; | ||
@mkdir($corpusDir); | ||
|
||
foreach ($it as $file) { | ||
if (!preg_match('/\.phpt$/', $file)) continue; | ||
$code = file_get_contents($file); | ||
if (!preg_match('/--FILE--(.*)--EXPECT/s', $code, $matches)) continue; | ||
$code = $matches[1]; | ||
|
||
$outFile = str_replace($testsDir, '', $file); | ||
$outFile = str_replace('/', '_', $outFile); | ||
$outFile = $corpusDir . '/' . $outFile; | ||
file_put_contents($outFile, $code); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
<?php | ||
|
||
$dict = ""; | ||
foreach (get_declared_classes() as $class) { | ||
$len = strlen($class); | ||
$dict .= "\"$len:\\\"$class\\\"\"\n"; | ||
} | ||
|
||
file_put_contents(__DIR__ . "/unserialize.dict", $dict); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,85 @@ | ||
"exit" | ||
"die" | ||
"fn" | ||
"function" | ||
"const" | ||
"return" | ||
"yield" | ||
"yield from" | ||
"try" | ||
"catch" | ||
"finally" | ||
"throw" | ||
"if" | ||
"elseif" | ||
"endif" | ||
"else" | ||
"while" | ||
"endwhile" | ||
"do" | ||
"for" | ||
"endfor" | ||
"foreach" | ||
"endforeach" | ||
"declare" | ||
"enddeclare" | ||
"instanceof" | ||
"as" | ||
"switch" | ||
"endswitch" | ||
"case" | ||
"default" | ||
"break" | ||
"continue" | ||
"goto" | ||
"echo" | ||
"print" | ||
"class" | ||
"interface" | ||
"trait" | ||
"extends" | ||
"implements" | ||
"new" | ||
"clone" | ||
"var" | ||
"int" | ||
"integer" | ||
"float" | ||
"double" | ||
"real" | ||
"string" | ||
"binary" | ||
"array" | ||
"object" | ||
"bool" | ||
"boolean" | ||
"unset" | ||
"eval" | ||
"include" | ||
"include_once" | ||
"require" | ||
"require_once" | ||
"namespace" | ||
"use" | ||
"insteadof" | ||
"global" | ||
"isset" | ||
"empty" | ||
"__halt_compiler" | ||
"static" | ||
"abstract" | ||
"final" | ||
"private" | ||
"protected" | ||
"public" | ||
"unset" | ||
"list" | ||
"callable" | ||
"__class__" | ||
"__trait__" | ||
"__function__" | ||
"__method__" | ||
"__line__" | ||
"__file__" | ||
"__dir__" | ||
"__namespace__" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
O:13:"ArrayIterator":2:{i:0;i:0;s:1:"x";R:2;} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
C:11:"ArrayObject":11:{x:i:0;r:3;X} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
C:16:"SplObjectStorage":113:{x:i:2;O:8:"stdClass":0:{},a:2:{s:4:"prev";i:2;s:4:"next";O:8:"stdClass":0:{}};r:7;,R:2;s:4:"next";;r:3;};m:a:0:{}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
a:2:{i:0;O:1:"0":2:0s:1:"0";i:0;s:1:"0";a:1:{i:0;C:11:"ArrayObject":7:{x:i:0;r} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
C:11:"ArrayObject":34:{x:i:1;O:8:"stdClass":1:{};m:a:0:{}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
O:8:"00000000": |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
O:9:"Exception":799999999999999999999999999997:0i:0;a:0:{}i:2;i:0;i:0;R:2; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
a:7:{i:0;i:04;s:1:"a";i:2;i:9617006;i:4;s:1:"a";i:4;s:1:"a";R:5;s:1:"7";R:3;s:1:"a";R:5;;s:18;}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
O:8:"stdClass":00000000 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
a:3020000000000000000000000000000001:{i:0;a:0:{}i:1;i:2;i:2;i:3;i:3;i:4;i:4;i:5;i:5;i:6;i:6;i:7;i:7;i:8;i:8;R:2;} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
a:9:{i:0;s:4:"0000";i:0;s:4:"0000";i:0;R:2;s:4:"5003";R:2;s:4:"0000";R:2;s:4:"0000";R:2;s:4:"000";R:2;s:4:"0000";d:0;s:4:"0000";a:9:{s:4:"0000"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.