Skip to content

Commit 4152ca5

Browse files
authored
Fix fuzzer support after CALL VM changes (#18491)
1 parent 4e23d3d commit 4152ca5

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

sapi/fuzzer/fuzzer-execute-common.h

+8-4
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,14 @@
2727
#define FILE_NAME "/tmp/fuzzer.php"
2828
#define MAX_STEPS 1000
2929
#define MAX_SIZE (8 * 1024)
30+
#define ZEND_VM_ENTER_BIT 1ULL
31+
3032
static uint32_t steps_left;
3133
static bool bailed_out = false;
3234

3335
/* Because the fuzzer is always compiled with clang,
3436
* we can assume that we don't use global registers / hybrid VM. */
35-
typedef int (ZEND_FASTCALL *opcode_handler_t)(zend_execute_data *);
37+
typedef zend_op *(ZEND_FASTCALL *opcode_handler_t)(zend_execute_data *, const zend_op *);
3638

3739
static zend_always_inline void fuzzer_bailout(void) {
3840
bailed_out = true;
@@ -51,11 +53,13 @@ static zend_always_inline void fuzzer_step(void) {
5153
static void (*orig_execute_ex)(zend_execute_data *execute_data);
5254

5355
static void fuzzer_execute_ex(zend_execute_data *execute_data) {
56+
const zend_op *opline = EX(opline);
5457
while (1) {
55-
int ret;
5658
fuzzer_step();
57-
if ((ret = ((opcode_handler_t) EX(opline)->handler)(execute_data)) != 0) {
58-
if (ret > 0) {
59+
opline = ((opcode_handler_t) opline->handler)(execute_data, opline);
60+
if ((uintptr_t) opline & ZEND_VM_ENTER_BIT) {
61+
opline = (const zend_op *) ((uintptr_t) opline & ~ZEND_VM_ENTER_BIT);
62+
if (opline) {
5963
execute_data = EG(current_execute_data);
6064
} else {
6165
return;

0 commit comments

Comments
 (0)