php-src

mirror of https://github.com/php/php-src.git synced 2024-09-22 02:17:32 +00:00

History

Nikita Popov 318fe06042 Create memory stream in exif fuzzer At least one segfault observed because temp file creation failed. Switch to using a memory stream, which should be more robust, and more efficient for that matter.		2020-02-19 10:24:12 +01:00
..
corpus	Add new entries for exif and unserialize fuzzing corpus	2019-09-24 12:34:30 +02:00
dict	Move scripts out of corpus/ directory	2019-09-16 20:18:29 +02:00
config.m4	Add --enable-fuzzer-msan flag	2019-10-01 13:04:47 +02:00
fuzzer-exif.c	Create memory stream in exif fuzzer	2020-02-19 10:24:12 +01:00
fuzzer-json.c	Remove mention of PHP major version in Copyright headers	2019-09-25 14:51:43 +02:00
fuzzer-mbstring.c	Further reduce parse depth limit in mbstring fuzzer	2019-12-14 22:43:15 +01:00
fuzzer-parser.c	Reduce size limit in parser fuzzer	2019-11-07 21:20:34 +01:00
fuzzer-sapi.c	Fix #78880 : Spelling error report	2019-12-21 11:58:00 +01:00
fuzzer-sapi.h	Remove mention of PHP major version in Copyright headers	2019-09-25 14:51:43 +02:00
fuzzer-unserialize.c	Remove mention of PHP major version in Copyright headers	2019-09-25 14:51:43 +02:00
fuzzer.h	Remove mention of PHP major version in Copyright headers	2019-09-25 14:51:43 +02:00
generate_parser_corpus.php	Reduce size limit in parser fuzzer	2019-11-07 21:20:34 +01:00
generate_unserialize_dict.php	Move scripts out of corpus/ directory	2019-09-16 20:18:29 +02:00
json.dict	Add fuzzer SAPIs to the core	2019-09-16 16:04:09 +02:00
Makefile.frag	Add fuzzer SAPIs to the core	2019-09-16 16:04:09 +02:00
README.md	Change instructions to use oniguruma from git	2019-09-18 14:56:25 +02:00

README.md

Fuzzing SAPI for PHP

The following ./configure options can be used to enable the fuzzing SAPI, as well as all availablefuzzers. If you don't build the exif/json/mbstring extensions, fuzzers for these extensions will not be built.

./configure \
    --enable-fuzzer \
    --with-pic \
    --enable-debug-assertions \
    --enable-exif \
    --enable-json \
    --enable-mbstring

The --with-pic option is required to avoid a linking failure. The --enable-debug-assertions option can be used to enable debug assertions despite the use of a release build.

You will need a recent version of clang that supports the -fsanitize=fuzzer-no-link option.

When running make it creates these binaries in sapi/fuzzer/:

php-fuzz-parser: Fuzzing language parser and compiler
php-fuzz-unserialize: Fuzzing unserialize() function
php-fuzz-json: Fuzzing JSON parser (requires --enable-json)
php-fuzz-exif: Fuzzing exif_read_data() function (requires --enable-exif)
php-fuzz-mbstring: fuzzing mb_ereg[i]() (requires --enable-mbstring)

Some fuzzers have a seed corpus in sapi/fuzzer/corpus. You can use it as follows:

cp -r sapi/fuzzer/corpus/exif ./my-exif-corpus
sapi/fuzzer/php-fuzz-exif ./my-exif-corpus

For the unserialize fuzzer, a dictionary of internal classes should be generated first:

sapi/cli/php sapi/fuzzer/generate_unserialize_dict.php
cp -r sapi/fuzzer/corpus/unserialize ./my-unserialize-corpus
sapi/fuzzer/php-fuzz-unserialize -dict=$PWD/sapi/fuzzer/dict/unserialize ./my-unserialize-corpus

For the parser fuzzer, a corpus may be generated from Zend test files:

sapi/cli/php sapi/fuzzer/generate_parser_corpus.php
mkdir ./my-parser-corpus
sapi/fuzzer/php-fuzz-parser -merge=1 ./my-parser-corpus sapi/fuzzer/corpus/parser
sapi/fuzzer/php-fuzz-parser -only_ascii=1 ./my-parser-corpus

For the mbstring fuzzer, you may want to build the libonig dependency with instrumentation. At this time, libonig is not clean under ubsan, so only the fuzzer and address sanitizers may be used.

git clone https://github.com/kkos/oniguruma.git
pushd oniguruma
autoreconf -vfi
./configure CC=clang CFLAGS="-fsanitize=fuzzer-no-link,address -O2 -g"
make
popd

export ONIG_CFLAGS="-I$PWD/oniguruma/src"
export ONIG_LIBS="-L$PWD/oniguruma/src/.libs -l:libonig.a"

This will link an instrumented libonig statically into the PHP binary.