[php-src] PR #24723: Use the default depth in the JSON fuzzer and check json_validate()
| From: | yumasansansan | Date: | Mon, 26 Oct 2026 07:24:29 +0000 |
| Subject: | [php-src] PR #24723: Use the default depth in the JSON fuzzer and check json_validate() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39896@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24723
Author: yumasansansan
-
php_json_parser_init(..., 10) has been in the fuzzer since it was added in 2019, with
no stated reason. json_decode() and json_validate() default to
PHP_JSON_PARSER_DEFAULT_DEPTH (512). The fuzzer now uses that.
- json_validate() (php_json_validate_ex()) runs the same scanner and
grammar with a separate set of parser methods that build no values. It was not covered by any
fuzzer. For JSON_OBJECT_AS_ARRAY (with and without
JSON_INVALID_UTF8_IGNORE), decoding fails exactly when validation fails, apart from
running out of memory, which cannot happen in this fuzzer. Decoding to objects is excluded because
it additionally rejects property names starting with a NUL byte. The fuzzer asserts that both agree.
Replaying the checked-in sapi/fuzzer/corpus/json (no fuzzing): edge coverage 1211 →
1257, and the assertion holds for every seed. The input format is unchanged.