Commit c338057

authored

sapi/fuzzer: Fetch function and call it directly instead of using a zval to hold the name (#19030)

1 parent 5a2a150 commit c338057Copy full SHA for c338057

File tree

+10

-8

lines changed

+10

-8

lines changed

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -127,15 +127,16 @@ ZEND_ATTRIBUTE_UNUSED static void create_file(void) {`
`127`	`127`	`ZEND_ATTRIBUTE_UNUSED static void opcache_invalidate(void) {`
`128`	`128`	`steps_left = MAX_STEPS;`
`129`	`129`	`zend_exception_save();`
`130`		`- zval retval, func, args[2];`
`131`		`- ZVAL_STRING(&func, "opcache_invalidate");`
	`130`	`+ zval retval, args[2];`
	`131`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), ZEND_STRL("opcache_invalidate"));`
	`132`	`+ ZEND_ASSERT(fn != NULL);`
	`133`	`+`
`132`	`134`	`ZVAL_STRING(&args[0], FILE_NAME);`
`133`	`135`	`ZVAL_TRUE(&args[1]);`
`134`		`- call_user_function(CG(function_table), NULL, &func, &retval, 2, args);`
	`136`	`+ zend_call_known_function(fn, NULL, NULL, &retval, 2, args, NULL);`
`135`	`137`	`ZEND_ASSERT(Z_TYPE(retval) == IS_TRUE);`
`136`	`138`	`zval_ptr_dtor(&args[0]);`
`137`	`139`	`zval_ptr_dtor(&retval);`
`138`		`- zval_ptr_dtor(&func);`
`139`	`140`	`zend_exception_restore();`
`140`	`141`	`}`
`141`	`142`

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -292,19 +292,20 @@ int fuzzer_do_request_from_buffer(`
`292`	`292`
`293`	`293`	`// Call named PHP function with N zval arguments`
`294`	`294`	`void fuzzer_call_php_func_zval(const char func_name, int nargs, zval args) {`
`295`		`- zval retval, func;`
	`295`	`+ zval retval;`
	`296`	`+`
	`297`	`+ zend_function *fn = zend_hash_str_find_ptr(CG(function_table), func_name, strlen(func_name));`
	`298`	`+ ZEND_ASSERT(fn != NULL);`
`296`	`299`
`297`		`- ZVAL_STRING(&func, func_name);`
`298`	`300`	`ZVAL_UNDEF(&retval);`
`299`		`- call_user_function(CG(function_table), NULL, &func, &retval, nargs, args);`
	`301`	`+ zend_call_known_function(fn, NULL, NULL, &retval, nargs, args, NULL);`
`300`	`302`
`301`	`303`	`// TODO: check result?`
`302`	`304`	`/* to ensure retval is not broken */`
`303`	`305`	`php_var_dump(&retval, 0);`
`304`	`306`
`305`	`307`	`/* cleanup */`
`306`	`308`	`zval_ptr_dtor(&retval);`
`307`		`- zval_ptr_dtor(&func);`
`308`	`309`	`}`
`309`	`310`
`310`	`311`	`// Call named PHP function with N string arguments`

Comments

(0)