diff --git a/sapi/fuzzer/Makefile.frag b/sapi/fuzzer/Makefile.frag index 57952a8ff4752..182e881c6c131 100644 --- a/sapi/fuzzer/Makefile.frag +++ b/sapi/fuzzer/Makefile.frag @@ -16,3 +16,6 @@ $(SAPI_FUZZER_PATH)/php-fuzz-exif: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZ $(SAPI_FUZZER_PATH)/php-fuzz-mbstring: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_MBSTRING_OBJS) $(FUZZER_BUILD) $(PHP_FUZZER_MBSTRING_OBJS) -o $@ + +$(SAPI_FUZZER_PATH)/php-fuzz-phar: $(PHP_GLOBAL_OBJS) $(PHP_SAPI_OBJS) $(PHP_FUZZER_PHAR_OBJS) + $(FUZZER_BUILD) $(PHP_FUZZER_PHAR_OBJS) -o $@ diff --git a/sapi/fuzzer/config.m4 b/sapi/fuzzer/config.m4 index 37945b8e9ea3f..5163c07fa43bc 100644 --- a/sapi/fuzzer/config.m4 +++ b/sapi/fuzzer/config.m4 @@ -87,6 +87,9 @@ if test "$PHP_FUZZER" != "no"; then if test -n "$enable_mbstring" && test "$enable_mbstring" != "no"; then PHP_FUZZER_TARGET([mbstring], PHP_FUZZER_MBSTRING_OBJS) fi + if test -n "$enable_phar" && test "$enable_phar" != "no"; then + PHP_FUZZER_TARGET([phar], PHP_FUZZER_PHAR_OBJS) + fi PHP_SUBST(PHP_FUZZER_BINARIES) fi diff --git a/sapi/fuzzer/corpus/phar/72321_1.zip b/sapi/fuzzer/corpus/phar/72321_1.zip new file mode 100644 index 0000000000000..ebc44ea282ce3 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/72321_1.zip differ diff --git a/sapi/fuzzer/corpus/phar/72321_2.zip b/sapi/fuzzer/corpus/phar/72321_2.zip new file mode 100644 index 0000000000000..de7ca266b8fd9 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/72321_2.zip differ diff --git a/sapi/fuzzer/corpus/phar/bug69324.phar b/sapi/fuzzer/corpus/phar/bug69324.phar new file mode 100644 index 0000000000000..0882d88c22421 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug69324.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug69441.phar b/sapi/fuzzer/corpus/phar/bug69441.phar new file mode 100644 index 0000000000000..80956dce7cb4f Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug69441.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug69453.tar.phar b/sapi/fuzzer/corpus/phar/bug69453.tar.phar new file mode 100644 index 0000000000000..655aa57e21704 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug69453.tar.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug69720.phar b/sapi/fuzzer/corpus/phar/bug69720.phar new file mode 100644 index 0000000000000..f62fb112802fe Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug69720.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug69958.tar b/sapi/fuzzer/corpus/phar/bug69958.tar new file mode 100644 index 0000000000000..02275248bd085 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug69958.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug70019.zip b/sapi/fuzzer/corpus/phar/bug70019.zip new file mode 100644 index 0000000000000..faf152df7e51c Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug70019.zip differ diff --git a/sapi/fuzzer/corpus/phar/bug70433.zip b/sapi/fuzzer/corpus/phar/bug70433.zip new file mode 100644 index 0000000000000..232a2210f59b8 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug70433.zip differ diff --git a/sapi/fuzzer/corpus/phar/bug71331.tar b/sapi/fuzzer/corpus/phar/bug71331.tar new file mode 100644 index 0000000000000..14eec28781e13 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug71331.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug71354.tar b/sapi/fuzzer/corpus/phar/bug71354.tar new file mode 100644 index 0000000000000..b0bd992b9e462 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug71354.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug71391.tar b/sapi/fuzzer/corpus/phar/bug71391.tar new file mode 100644 index 0000000000000..a5b155ac87f42 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug71391.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug71488.tar b/sapi/fuzzer/corpus/phar/bug71488.tar new file mode 100644 index 0000000000000..6e1419502593a Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug71488.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug71498.zip b/sapi/fuzzer/corpus/phar/bug71498.zip new file mode 100644 index 0000000000000..ae78dd871e32b Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug71498.zip differ diff --git a/sapi/fuzzer/corpus/phar/bug72928.zip b/sapi/fuzzer/corpus/phar/bug72928.zip new file mode 100644 index 0000000000000..c480c5f537c95 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug72928.zip differ diff --git a/sapi/fuzzer/corpus/phar/bug73035.tar b/sapi/fuzzer/corpus/phar/bug73035.tar new file mode 100644 index 0000000000000..d8e426866bdeb Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug73035.tar differ diff --git a/sapi/fuzzer/corpus/phar/bug73764.phar b/sapi/fuzzer/corpus/phar/bug73764.phar new file mode 100644 index 0000000000000..89a5ff65426d1 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug73764.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug73768.phar b/sapi/fuzzer/corpus/phar/bug73768.phar new file mode 100644 index 0000000000000..3f429c2365058 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug73768.phar differ diff --git a/sapi/fuzzer/corpus/phar/bug77143.phar b/sapi/fuzzer/corpus/phar/bug77143.phar new file mode 100644 index 0000000000000..eb797b5195759 Binary files /dev/null and b/sapi/fuzzer/corpus/phar/bug77143.phar differ diff --git a/sapi/fuzzer/fuzzer-phar.c b/sapi/fuzzer/fuzzer-phar.c new file mode 100644 index 0000000000000..cadc3e15d5b08 --- /dev/null +++ b/sapi/fuzzer/fuzzer-phar.c @@ -0,0 +1,77 @@ +/* + +----------------------------------------------------------------------+ + | Copyright (c) The PHP Group | + +----------------------------------------------------------------------+ + | This source file is subject to version 3.01 of the PHP license, | + | that is bundled with this package in the file LICENSE, and is | + | available through the world-wide-web at the following url: | + | http://www.php.net/license/3_01.txt | + | If you did not receive a copy of the PHP license and are unable to | + | obtain it through the world-wide-web, please send a note to | + | license@php.net so we can mail you a copy immediately. | + +----------------------------------------------------------------------+ + | Authors: Stanislav Malyshev | + +----------------------------------------------------------------------+ + */ + +#include "fuzzer.h" + +#include "Zend/zend.h" +#include "main/php_config.h" +#include "main/php_main.h" + +#include +#include +#include +#include +#include +#include + +#include "fuzzer-sapi.h" + +int phar_create_or_parse_filename(char *fname, size_t fname_len, char *alias, size_t alias_len, zend_bool is_data, uint32_t options, void** pphar, char **error); +void phar_request_initialize(void); + +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + void *phar_data; + char *tmp_filename; + int tmpfd; + + if (Size > 256 * 1024) { + /* Large inputs have a large impact on fuzzer performance, + * but are unlikely to be necessary to reach new codepaths. */ + return 0; + } + + if (fuzzer_request_startup() == FAILURE) { + return 0; + } + phar_request_initialize(); + + tmp_filename = estrdup("/tmp/phar-fuzz.temp.XXXXXX"); + tmpfd = mkstemp(tmp_filename); + write(tmpfd, Data, Size); + close(tmpfd); + + zend_first_try { + phar_create_or_parse_filename(tmp_filename, strlen(tmp_filename), NULL, 0, 1, REPORT_ERRORS, &phar_data, NULL); + } zend_end_try(); + + /* cleanup */ + unlink(tmp_filename); + efree(tmp_filename); + php_request_shutdown(NULL); + + return 0; +} + +int LLVMFuzzerInitialize(int *argc, char ***argv) { + /* Gracefully handle bailouts. */ + putenv("USE_TRACKED_ALLOC=1"); + + fuzzer_init_php(); + + /* fuzzer_shutdown_php(); */ + return 0; +} +