File tree 1 file changed +8
-4
lines changed
1 file changed +8
-4
lines changed Original file line number Diff line number Diff line change 27
27
#define FILE_NAME "/tmp/fuzzer.php"
28
28
#define MAX_STEPS 1000
29
29
#define MAX_SIZE (8 * 1024)
30
+ #define ZEND_VM_ENTER_BIT 1ULL
31
+
30
32
static uint32_t steps_left ;
31
33
static bool bailed_out = false;
32
34
33
35
/* Because the fuzzer is always compiled with clang,
34
36
* we can assume that we don't use global registers / hybrid VM. */
35
- typedef int (ZEND_FASTCALL * opcode_handler_t )(zend_execute_data * );
37
+ typedef zend_op * (ZEND_FASTCALL * opcode_handler_t )(zend_execute_data * , const zend_op * );
36
38
37
39
static zend_always_inline void fuzzer_bailout (void ) {
38
40
bailed_out = true;
@@ -51,11 +53,13 @@ static zend_always_inline void fuzzer_step(void) {
51
53
static void (* orig_execute_ex )(zend_execute_data * execute_data );
52
54
53
55
static void fuzzer_execute_ex (zend_execute_data * execute_data ) {
56
+ const zend_op * opline = EX (opline );
54
57
while (1 ) {
55
- int ret ;
56
58
fuzzer_step ();
57
- if ((ret = ((opcode_handler_t ) EX (opline )-> handler )(execute_data )) != 0 ) {
58
- if (ret > 0 ) {
59
+ opline = ((opcode_handler_t ) opline -> handler )(execute_data , opline );
60
+ if ((uintptr_t ) opline & ZEND_VM_ENTER_BIT ) {
61
+ opline = (const zend_op * ) ((uintptr_t ) opline & ~ZEND_VM_ENTER_BIT );
62
+ if (opline ) {
59
63
execute_data = EG (current_execute_data );
60
64
} else {
61
65
return ;
You can’t perform that action at this time.
0 commit comments