diff --git a/sapi/fuzzer/fuzzer-exif.c b/sapi/fuzzer/fuzzer-exif.c index 66de0735a727..98f571f7ccac 100644 --- a/sapi/fuzzer/fuzzer-exif.c +++ b/sapi/fuzzer/fuzzer-exif.c @@ -31,7 +31,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { #ifdef HAVE_EXIF php_stream *stream; - zval stream_zv; + zval args[4]; if (Size > 256 * 1024) { /* Large inputs have a large impact on fuzzer performance, @@ -45,11 +45,24 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { stream = php_stream_memory_create(TEMP_STREAM_DEFAULT); php_stream_write(stream, (const char *) Data, Size); - php_stream_to_zval(stream, &stream_zv); + php_stream_to_zval(stream, &args[0]); - fuzzer_call_php_func_zval("exif_read_data", 1, &stream_zv); + /* exif_read_data($stream, null, false, true): the thumbnail is only read if requested. */ + ZVAL_NULL(&args[1]); + ZVAL_FALSE(&args[2]); + ZVAL_TRUE(&args[3]); + fuzzer_call_php_func_zval("exif_read_data", 4, args); - zval_ptr_dtor(&stream_zv); + /* exif_thumbnail($stream, $width, $height, $type): the thumbnail is only scanned for its + * dimensions if they are requested. */ + for (int i = 1; i < 4; i++) { + ZVAL_NEW_EMPTY_REF(&args[i]); + ZVAL_NULL(Z_REFVAL(args[i])); + } + fuzzer_call_php_func_zval("exif_thumbnail", 4, args); + for (int i = 0; i < 4; i++) { + zval_ptr_dtor(&args[i]); + } /* cleanup */ php_request_shutdown(NULL);