Commit 843c5f0

committed

sapi/fuzzer: Fetch function and call it directly instead of using a zval to hold the name

1 parent 75006cf commit 843c5f0Copy full SHA for 843c5f0

File tree

-6

lines changed

-6

lines changed

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -127,15 +127,16 @@ ZEND_ATTRIBUTE_UNUSED static void create_file(void) {`
`127`	`127`	`ZEND_ATTRIBUTE_UNUSED static void opcache_invalidate(void) {`
`128`	`128`	`steps_left = MAX_STEPS;`
`129`	`129`	`zend_exception_save();`
`130`		`- zval retval, func, args[2];`
`131`		`- ZVAL_STRING(&func, "opcache_invalidate");`
	`130`	`+ zval retval, args[2];`
	`131`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), ZEND_STRL("opcache_invalidate"));`
	`132`	`+ ZEND_ASSERT(fn != NULL);`
	`133`	`+`
`132`	`134`	`ZVAL_STRING(&args[0], FILE_NAME);`
`133`	`135`	`ZVAL_TRUE(&args[1]);`
`134`		`- call_user_function(CG(function_table), NULL, &func, &retval, 2, args);`
	`136`	`+ zend_call_known_function(fn, NULL, NULL, &retval, 2, args, NULL);`
`135`	`137`	`ZEND_ASSERT(Z_TYPE(retval) == IS_TRUE);`
`136`	`138`	`zval_ptr_dtor(&args[0]);`
`137`	`139`	`zval_ptr_dtor(&retval);`
`138`		`- zval_ptr_dtor(&func);`
`139`	`140`	`zend_exception_restore();`
`140`	`141`	`}`
`141`	`142`

Lines changed: 4 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -294,9 +294,11 @@ int fuzzer_do_request_from_buffer(`
`294`	`294`	`void fuzzer_call_php_func_zval(const char func_name, int nargs, zval args) {`
`295`	`295`	`zval retval, func;`
`296`	`296`
`297`		`- ZVAL_STRING(&func, func_name);`
	`297`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), func_name, strlen(func_name));`
	`298`	`+ ZEND_ASSERT(fn != NULL);`
	`299`	`+`
`298`	`300`	`ZVAL_UNDEF(&retval);`
`299`		`- call_user_function(CG(function_table), NULL, &func, &retval, nargs, args);`
	`301`	`+ zend_call_known_function(fn, NULL, NULL, &retval, nargs, args, NULL);`
`300`	`302`
`301`	`303`	`// TODO: check result?`
`302`	`304`	`/* to ensure retval is not broken */`

Comments

(0)