From 14106034af81d341aafb4a2d70383a72f4b9c86e Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Wed, 23 Sep 2026 20:28:47 -0700 Subject: [PATCH] JSON fuzzer: use options for handling invalid UTF-8 and big strings Previously, the fuzzer only used the default options (`0`) and the `PHP_JSON_OBJECT_AS_ARRAY` option (`1`). After running the fuzzer on its existing corpus with `-reduce_inputs=0`, `-runs=100000`, and `-seed=1`, it failed to reach the code paths for handling big integers and strings, or for dealing with invalid UTF8, within the allotted 100,000 runs. Those 100,000 runs resulted in coverage of roughly 2,020 code blocks or edges, and roughly 5,400 "features". Expand the fuzzer to also run with options that include the `PHP_JSON_BIGINT_AS_STRING`, `PHP_JSON_INVALID_UTF8_IGNORE`, and `PHP_JSON_INVALID_UTF8_SUBSTITUTE` flags. The two flags for handling UTF-8 are not applied used together, since invalid UTF-8 can only be handled one way, but other than that all combinations of these flags and `PHP_JSON_OBJECT_AS_ARRAY` are now tested. Repeating the same fuzzing as earlier with the expanded options results in roughly 2,150 code blocks or edges, and roughly 5,700 "features", being covered. --- sapi/fuzzer/fuzzer-json.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/sapi/fuzzer/fuzzer-json.c b/sapi/fuzzer/fuzzer-json.c index 5029cb9a585d..0407a895835e 100644 --- a/sapi/fuzzer/fuzzer-json.c +++ b/sapi/fuzzer/fuzzer-json.c @@ -24,6 +24,7 @@ #include #include "fuzzer-sapi.h" +#include "ext/json/php_json.h" #include "ext/json/php_json_parser.h" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { @@ -36,10 +37,25 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { memcpy(data, Data, Size); data[Size] = '\0'; - for (int option = 0; option <=1; ++option) { + int options[12] = { + 0, + PHP_JSON_OBJECT_AS_ARRAY, + PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING, + PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE, + PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE, + PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_IGNORE, + PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_SUBSTITUTE, + PHP_JSON_BIGINT_AS_STRING, + PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE, + PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE, + PHP_JSON_INVALID_UTF8_IGNORE, + PHP_JSON_INVALID_UTF8_SUBSTITUTE + }; + + for (int index = 0; index < 12; ++index) { zval result; php_json_parser parser; - php_json_parser_init(&parser, &result, data, Size, option, 10); + php_json_parser_init(&parser, &result, data, Size, options[index], 10); if (php_json_yyparse(&parser) == SUCCESS) { zval_ptr_dtor(&result); }