php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-18082: Memory leaks in fuzzer SAPI error paths
This commit is contained in:
Niels Dossche
2025-03-16 16:39:01 +01:00
parent 798e27286e a67f351b67
commit 6d6ac81d41
4 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
sapi/fuzzer/fuzzer-json.c
View File

@@ -15,8 +15,6 @@
+----------------------------------------------------------------------+
*/
#include "fuzzer.h"
#include "Zend/zend.h"
@@ -31,14 +29,15 @@
#include "ext/json/php_json_parser.h"
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
char *data = malloc(Size+1);
memcpy(data, Data, Size);
data[Size] = '\0';
if (fuzzer_request_startup() == FAILURE) {
if (fuzzer_request_startup() == FAILURE){
return 0;
}
char *data = malloc(Size + 1);
memcpy(data, Data, Size);
data[Size] = '\0';
for (int option = 0; option <=1; ++option) {
zval result;
php_json_parser parser;

9
sapi/fuzzer/fuzzer-mbregex.c
View File

@@ -30,15 +30,16 @@
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
#ifdef HAVE_MBREGEX
char *args[2];
char *data = malloc(Size+1);
memcpy(data, Data, Size);
data[Size] = '\0';
if (fuzzer_request_startup() == FAILURE) {
return 0;
}
char *args[2];
char *data = malloc(Size+1);
memcpy(data, Data, Size);
data[Size] = '\0';
fuzzer_setup_dummy_frame();
args[0] = data;

7
sapi/fuzzer/fuzzer-unserialize.c
View File

@@ -30,14 +30,15 @@
#include "ext/standard/php_var.h"
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
unsigned char *orig_data = malloc(Size+1);
memcpy(orig_data, Data, Size);
orig_data[Size] = '\0';
if (fuzzer_request_startup() == FAILURE) {
return 0;
}
unsigned char *orig_data = malloc(Size+1);
memcpy(orig_data, Data, Size);
orig_data[Size] = '\0';
fuzzer_setup_dummy_frame();
{

8
sapi/fuzzer/fuzzer-unserializehash.c
View File

@@ -34,15 +34,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t FullSize) {
}
++Start;
if (fuzzer_request_startup() == FAILURE) {
return 0;
}
size_t Size = (Data + FullSize) - Start;
unsigned char *orig_data = malloc(Size+1);
memcpy(orig_data, Start, Size);
orig_data[Size] = '\0';
if (fuzzer_request_startup() == FAILURE) {
return 0;
}
fuzzer_setup_dummy_frame();
{