mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
Yuma Kakei
6f6964b5b3
Since the default of opcache.jit changed from "tracing" to "disable"
(c16ad918ba, RFC jit_config_defaults), JIT_G(enabled) is false after
startup and zend_jit_config() rejects every runtime change of
opcache.jit. The function-jit and tracing-jit fuzzers turn the JIT on
at runtime without checking the result, so since PHP 8.4 they have only
been running the VM. The OSS-Fuzz coverage report of 2026-10-24 shows
0.04% line coverage (40/103166) for ext/opcache/jit/.
Start with opcache.jit=off, which keeps the JIT available, and abort if
switching the JIT mode fails, so that this cannot regress silently.
62 lines
2.2 KiB
C
62 lines
2.2 KiB
C
/*
|
|
+----------------------------------------------------------------------+
|
|
| Copyright © The PHP Group and Contributors. |
|
|
+----------------------------------------------------------------------+
|
|
| This source file is subject to the Modified BSD License that is |
|
|
| bundled with this package in the file LICENSE, and is available |
|
|
| through the World Wide Web at <https://www.php.net/license/>. |
|
|
| |
|
|
| SPDX-License-Identifier: BSD-3-Clause |
|
|
+----------------------------------------------------------------------+
|
|
| Authors: Nikita Popov <nikic@php.net> |
|
|
+----------------------------------------------------------------------+
|
|
*/
|
|
|
|
#include "fuzzer-execute-common.h"
|
|
|
|
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|
if (Size > MAX_SIZE) {
|
|
/* Large inputs have a large impact on fuzzer performance,
|
|
* but are unlikely to be necessary to reach new codepaths. */
|
|
return 0;
|
|
}
|
|
|
|
zend_string *jit_option = ZSTR_INIT_LITERAL("opcache.jit", 1);
|
|
|
|
/* First run without JIT to determine whether we bail out. We should not run JITed code if
|
|
* we bail out here, as the JIT code may loop infinitely. */
|
|
steps_left = MAX_STEPS;
|
|
bailed_out = false;
|
|
set_jit_option(jit_option, "off");
|
|
fuzzer_do_request_from_buffer(
|
|
FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
|
|
|
|
if (!bailed_out) {
|
|
steps_left = MAX_STEPS;
|
|
set_jit_option(jit_option, "function");
|
|
zend_execute_ex = orig_execute_ex;
|
|
fuzzer_do_request_from_buffer(
|
|
FILE_NAME, (const char *) Data, Size, /* execute */ 1, opcache_invalidate);
|
|
zend_execute_ex = fuzzer_execute_ex;
|
|
}
|
|
|
|
zend_string_release(jit_option);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int LLVMFuzzerInitialize(int *argc, char ***argv) {
|
|
char ini_buf[512];
|
|
snprintf(ini_buf, sizeof(ini_buf),
|
|
/* The default opcache.jit=disable does not allow enabling the JIT at runtime. */
|
|
"opcache.jit=off\n"
|
|
"opcache.validate_timestamps=0\n"
|
|
"opcache.file_update_protection=0\n"
|
|
"opcache.jit_buffer_size=128M\n"
|
|
"opcache.protect_memory=1\n");
|
|
|
|
create_file();
|
|
fuzzer_init_php_for_execute(ini_buf);
|
|
return 0;
|
|
}
|