Commit 186f816

committed

sapi/fuzzer: Fetch function and call it directly instead of using a zval to hold the name

1 parent 75006cf commit 186f816Copy full SHA for 186f816

File tree

+18

-6

lines changed

+18

-6

lines changed

Lines changed: 8 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -23,6 +23,9 @@`
`23`	`23`	`#include "fuzzer.h"`
`24`	`24`	`#include "fuzzer-sapi.h"`
`25`	`25`	`#include "zend_exceptions.h"`
	`26`	`+#include "../../Zend/zend_API.h"`
	`27`	`+#include "../../Zend/zend_frameless_function.h"`
	`28`	`+#include "../../Zend/zend_hash.h"`
`26`	`29`
`27`	`30`	`#define FILE_NAME "/tmp/fuzzer.php"`
`28`	`31`	`#define MAX_STEPS 1000`
`@@ -127,15 +130,16 @@ ZEND_ATTRIBUTE_UNUSED static void create_file(void) {`
`127`	`130`	`ZEND_ATTRIBUTE_UNUSED static void opcache_invalidate(void) {`
`128`	`131`	`steps_left = MAX_STEPS;`
`129`	`132`	`zend_exception_save();`
`130`		`- zval retval, func, args[2];`
`131`		`- ZVAL_STRING(&func, "opcache_invalidate");`
	`133`	`+ zval retval, args[2];`
	`134`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), ZEND_STRL("opcache_invalidate"));`
	`135`	`+ ZEND_ASSERT(fn != NULL);`
	`136`	`+`
`132`	`137`	`ZVAL_STRING(&args[0], FILE_NAME);`
`133`	`138`	`ZVAL_TRUE(&args[1]);`
`134`		`- call_user_function(CG(function_table), NULL, &func, &retval, 2, args);`
	`139`	`+ zend_call_known_function(fn, NULL, NULL, &retval, 2, args, NULL);`
`135`	`140`	`ZEND_ASSERT(Z_TYPE(retval) == IS_TRUE);`
`136`	`141`	`zval_ptr_dtor(&args[0]);`
`137`	`142`	`zval_ptr_dtor(&retval);`
`138`		`- zval_ptr_dtor(&func);`
`139`	`143`	`zend_exception_restore();`
`140`	`144`	`}`
`141`	`145`

Lines changed: 10 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,12 @@`
`30`	`30`	`#include "fuzzer.h"`
`31`	`31`	`#include "fuzzer-sapi.h"`
`32`	`32`
	`33`	`+#include <string.h>`
	`34`	`+`
	`35`	`+#include "../../Zend/zend_API.h"`
	`36`	`+#include "../../Zend/zend_frameless_function.h"`
	`37`	`+#include "../../Zend/zend_hash.h"`
	`38`	`+`
`33`	`39`	`static const char HARDCODED_INI[] =`
`34`	`40`	`"html_errors=0\n"`
`35`	`41`	`"implicit_flush=1\n"`
`@@ -294,9 +300,11 @@ int fuzzer_do_request_from_buffer(`
`294`	`300`	`void fuzzer_call_php_func_zval(const char func_name, int nargs, zval args) {`
`295`	`301`	`zval retval, func;`
`296`	`302`
`297`		`- ZVAL_STRING(&func, func_name);`
	`303`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), func_name, strlen(func_name));`
	`304`	`+ ZEND_ASSERT(fn != NULL);`
	`305`	`+`
`298`	`306`	`ZVAL_UNDEF(&retval);`
`299`		`- call_user_function(CG(function_table), NULL, &func, &retval, nargs, args);`
	`307`	`+ zend_call_known_function(fn, NULL, NULL, &retval, nargs, args, NULL);`
`300`	`308`
`301`	`309`	`// TODO: check result?`
`302`	`310`	`/* to ensure retval is not broken */`

Comments

(0)