[php-src] PR #24726: Add a dictionary for the execute and JIT fuzzers
| From: | yumasansansan | Date: | Mon, 26 Oct 2026 07:48:17 +0000 |
| Subject: | [php-src] PR #24726: Add a dictionary for the execute and JIT fuzzers | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39899@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24726
Author: yumasansansan
php-fuzz-execute, php-fuzz-function-jit and
php-fuzz-tracing-jit run without a dictionary on OSS-Fuzz. Function and class names are
resolved through hash table lookups, so libFuzzer's comparison tracing does not help to
discover them, and reaching an internal function requires guessing its name.
generate_execute_dict.php (called from generate_all.php) writes
dict/execute: the keywords from dict/parser plus all internal functions,
classes and interfaces of the build (1111 entries with --disable-all --enable-exif
--enable-mbstring --enable-session), escaped for libFuzzer. libFuzzer accepts the file
(Dictionary: 1111 entries).
The README also referred to php-fuzzer-function-jit; the binary is
php-fuzz-function-jit.
For OSS-Fuzz to use the dictionary, projects/php/build.sh in google/oss-fuzz has to
copy it to $OUT/php-fuzz-execute.dict (and likewise for the JIT fuzzers). That change
will be submitted to google/oss-fuzz separately.