fuzz: disable Zend's arena allocator under go-118-fuzz-build - #2604
Merged
Conversation
Zend's own arena allocator reuses freed memory in ways that hide bugs from ASan/MSan; disabling it (USE_ZEND_ALLOC=0) is already required for the sanitizer CI jobs (.github/workflows/sanitizers.yaml), but that env var never reaches a libFuzzer binary built by OSS-Fuzz: build.sh runs in a throwaway build container, and ClusterFuzz later execs the compiled fuzzer as a fresh process on a different bot with no inherited env. The libFuzzer .options file can't fill the gap either, since ClusterFuzz whitelists its [env] section down to two unrelated variables. Setting it from an init() gated on the "gofuzz" build tag reaches the process before PHP starts, without touching any non-fuzzing build.
2 tasks
alexandre-daubois
pushed a commit
that referenced
this pull request
Aug 16, 2026
## Summary `TestAddModuleWorkerViaAdminApi` POSTs a full config to the admin `/load` endpoint, which swaps the HTTP listener for the new config, then immediately GETs the newly added worker. A request racing that listener swap can hit a reset connection (`EOF`) before the worker ever sees it — seen on CI in [#2604](#2604) (job [94991854286](https://github.com/php/frankenphp/actions/runs/31876064293/job/94991854286)), and matches the same class of flake fixed for the sibling autoscale tests in #2413 (which references this test too, on #2412/#2381). Retry only on connection-level errors (`err != nil` from `http.Get`), not on the request/response itself: once a request actually reaches the worker it always increments its counter, so retrying past a successful connection would break the `requests:1` assertion. ## Test plan - [x] `./go.sh -C caddy test ./...` passes - [x] `./go.sh -C caddy test ./... -run TestAddModuleWorkerViaAdminApi -count=5` passes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of adding FrankenPHP to OSS-Fuzz. The OSS-Fuzz Dockerfile/build.sh compile PHP from source and build the existing
FuzzRequestnative Go fuzz target (frankenphp_test.go) withcompile_native_go_fuzzer, linking against a sanitizer-instrumentedlibphp.Zend's own arena allocator reuses freed memory in ways that hide bugs from ASan/MSan. Disabling it (
USE_ZEND_ALLOC=0) is already required for the sanitizer CI jobs in .github/workflows/sanitizers.yaml, but that env var can't reach a libFuzzer binary built by OSS-Fuzz the same way:build.shruns in a throwaway build container; ClusterFuzz later executes the compiled fuzzer as a fresh process on a different bot with no inherited environment..optionsfile's[env]section looks like it should fill the gap, but ClusterFuzz whitelists it down to two unrelated variables (AFL_DONT_DEFER,GODEBUG), soUSE_ZEND_ALLOCthere is silently dropped.Setting it from an
init()gated on thegofuzzbuild tag reaches the process before PHP starts, without affecting any non-fuzzing build (the CLI, the Caddy module, or anything else built by consumers of this module).Test plan
google/oss-fuzz(infra/helper.py build_image/build_fuzzers) with a matchingprojects/frankenphp/{project.yaml,Dockerfile,build.sh}, to be submitted as a separate PR to that repo.