Skip to content

Commit 83fccc6

Browse files
committed
Consistently set bailed_out flag
It was not set for some of the bailouts, resulting in timeouts in the function JIT fuzzer. Fixes oss-fuzz #39293.
1 parent 2a3caef commit 83fccc6

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

sapi/fuzzer/fuzzer-execute-common.h

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,17 @@ static bool bailed_out = false;
3030
* we can assume that we don't use global registers / hybrid VM. */
3131
typedef int (ZEND_FASTCALL *opcode_handler_t)(zend_execute_data *);
3232

33+
static zend_always_inline void fuzzer_bailout(void) {
34+
bailed_out = true;
35+
zend_bailout();
36+
}
37+
3338
static zend_always_inline void fuzzer_step(void) {
3439
if (--steps_left == 0) {
3540
/* Reset steps before bailing out, so code running after bailout (e.g. in
3641
* destructors) will get another MAX_STEPS, rather than UINT32_MAX steps. */
3742
steps_left = MAX_STEPS;
38-
bailed_out = true;
39-
zend_bailout();
43+
fuzzer_bailout();
4044
}
4145
}
4246

@@ -61,7 +65,7 @@ static zend_op_array *(*orig_compile_string)(zend_string *source_string, const c
6165
static zend_op_array *fuzzer_compile_string(zend_string *str, const char *filename) {
6266
if (ZSTR_LEN(str) > MAX_SIZE) {
6367
/* Avoid compiling huge inputs via eval(). */
64-
zend_bailout();
68+
fuzzer_bailout();
6569
}
6670

6771
return orig_compile_string(str, filename);
@@ -78,7 +82,7 @@ static void fuzzer_execute_internal(zend_execute_data *execute_data, zval *retur
7882
* Limit the maximum size of string inputs. */
7983
zval *arg = ZEND_CALL_VAR_NUM(execute_data, i);
8084
if (Z_TYPE_P(arg) == IS_STRING && Z_STRLEN_P(arg) > MAX_SIZE) {
81-
zend_bailout();
85+
fuzzer_bailout();
8286
}
8387
}
8488

0 commit comments

Comments
 (0)