Skip to content

Commit c8da762

Browse files
committedMar 16, 2025
Fix memory leaks in sapi/fuzzer
1 parent 005c7b5 commit c8da762

File tree

4 files changed

+21
-18
lines changed

4 files changed

+21
-18
lines changed
 

‎sapi/fuzzer/fuzzer-json.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,15 @@
3131
#include "ext/json/php_json_parser.h"
3232

3333
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
34-
char *data = malloc(Size+1);
35-
memcpy(data, Data, Size);
36-
data[Size] = '\0';
3734

38-
if (fuzzer_request_startup() == FAILURE) {
35+
if (fuzzer_request_startup() == FAILURE) {
3936
return 0;
4037
}
4138

39+
char *data = malloc(Size+1);
40+
memcpy(data, Data, Size);
41+
data[Size] = '\0';
42+
4243
for (int option = 0; option <=1; ++option) {
4344
zval result;
4445
php_json_parser parser;

‎sapi/fuzzer/fuzzer-mbregex.c

+6-5
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,16 @@
3030

3131
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
3232
#ifdef HAVE_MBREGEX
33-
char *args[2];
34-
char *data = malloc(Size+1);
35-
memcpy(data, Data, Size);
36-
data[Size] = '\0';
37-
33+
3834
if (fuzzer_request_startup() == FAILURE) {
3935
return 0;
4036
}
4137

38+
char *args[2];
39+
char *data = malloc(Size+1);
40+
memcpy(data, Data, Size);
41+
data[Size] = '\0';
42+
4243
fuzzer_setup_dummy_frame();
4344

4445
args[0] = data;

‎sapi/fuzzer/fuzzer-unserialize.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,15 @@
3030
#include "ext/standard/php_var.h"
3131

3232
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
33-
unsigned char *orig_data = malloc(Size+1);
34-
memcpy(orig_data, Data, Size);
35-
orig_data[Size] = '\0';
3633

37-
if (fuzzer_request_startup() == FAILURE) {
34+
if (fuzzer_request_startup() == FAILURE) {
3835
return 0;
3936
}
4037

38+
unsigned char *orig_data = malloc(Size+1);
39+
memcpy(orig_data, Data, Size);
40+
orig_data[Size] = '\0';
41+
4142
fuzzer_setup_dummy_frame();
4243

4344
{

‎sapi/fuzzer/fuzzer-unserializehash.c

+5-5
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t FullSize) {
3434
}
3535
++Start;
3636

37-
size_t Size = (Data + FullSize) - Start;
38-
unsigned char *orig_data = malloc(Size+1);
39-
memcpy(orig_data, Start, Size);
40-
orig_data[Size] = '\0';
41-
4237
if (fuzzer_request_startup() == FAILURE) {
4338
return 0;
4439
}
4540

41+
size_t Size = (Data + FullSize) - Start;
42+
unsigned char *orig_data = malloc(Size+1);
43+
memcpy(orig_data, Start, Size);
44+
orig_data[Size] = '\0';
45+
4646
fuzzer_setup_dummy_frame();
4747

4848
{

0 commit comments

Comments
 (0)
Failed to load comments.