[php-src] PR #23877: JSON fuzzer: use options for handling invalid UTF-8 and big strings
| From: | DanielEScherzer | Date: | Thu, 24 Sep 2026 03:29:31 +0000 |
| Subject: | [php-src] PR #23877: JSON fuzzer: use options for handling invalid UTF-8 and big strings | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38759@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23877
Author: DanielEScherzer
Previously, the fuzzer only used the default options (
0) and the
PHP_JSON_OBJECT_AS_ARRAY option (1). After running the fuzzer on its
existing corpus with -reduce_inputs=0, -runs=100000, and
-seed=1, it failed to reach the code paths for handling big integers and strings, or
for dealing with invalid UTF8, within the allotted 100,000 runs. Those 100,000 runs resulted in
coverage of roughly 2,020 code blocks or edges, and roughly 5,400 "features".
Expand the fuzzer to also run with options that include the PHP_JSON_BIGINT_AS_STRING,
PHP_JSON_INVALID_UTF8_IGNORE, and PHP_JSON_INVALID_UTF8_SUBSTITUTE flags.
The two flags for handling UTF-8 are not applied used together, since invalid UTF-8 can only be
handled one way, but other than that all combinations of these flags and
PHP_JSON_OBJECT_AS_ARRAY are now tested. Repeating the same fuzzing as earlier with the
expanded options results in roughly 2,150 code blocks or edges, and roughly 5,700
"features", being covered.