Repository navigation
Add a dictionary for the execute and JIT fuzzers - #24726
Open
yumasansansan wants to merge 1 commit into
Open
yumasansansan wants to merge 1 commit into
yumasansansan wants to merge 1 commit into
Conversation
Internal functions and classes are looked up through hash tables, so the fuzzer cannot learn their names from comparisons. Generate a dictionary of internal functions, classes and interfaces, combined with the keywords of the parser dictionary. Also fix the fuzzer name in the README.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
php-fuzz-execute,php-fuzz-function-jitandphp-fuzz-tracing-jitrun without a dictionary on OSS-Fuzz. Function and class names are resolved through hash table lookups, so libFuzzer's comparison tracing does not help to discover them, and reaching an internal function requires guessing its name.generate_execute_dict.php(called fromgenerate_all.php) writesdict/execute: the keywords fromdict/parserplus all internal functions, classes and interfaces of the build (1111 entries with--disable-all --enable-exif --enable-mbstring --enable-session), escaped for libFuzzer. libFuzzer accepts the file (Dictionary: 1111 entries).The README also referred to
php-fuzzer-function-jit; the binary isphp-fuzz-function-jit.For OSS-Fuzz to use the dictionary,
projects/php/build.shin google/oss-fuzz has to copy it to$OUT/php-fuzz-execute.dict(and likewise for the JIT fuzzers). That change will be submitted to google/oss-fuzz separately.