Skip to content

Commit f10a6ba

Browse files
Implemented suggestion: moved allocation under request initialization to avoid unnecessary free call
1 parent 7df81c5 commit f10a6ba

File tree

4 files changed

+20
-21
lines changed

4 files changed

+20
-21
lines changed

sapi/fuzzer/fuzzer-json.c

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@
3131
#include "ext/json/php_json_parser.h"
3232

3333
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
34-
char *data = malloc(Size+1);
35-
memcpy(data, Data, Size);
36-
data[Size] = '\0';
3734

38-
if (fuzzer_request_startup() == FAILURE) {
39-
free(data);
35+
if (fuzzer_request_startup() == FAILURE) {
4036
return 0;
4137
}
4238

39+
char *data = malloc(Size+1);
40+
memcpy(data, Data, Size);
41+
data[Size] = '\0';
42+
4343
for (int option = 0; option <=1; ++option) {
4444
zval result;
4545
php_json_parser parser;

sapi/fuzzer/fuzzer-mbregex.c

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@
3131
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
3232
#ifdef HAVE_MBREGEX
3333
char *args[2];
34-
char *data = malloc(Size+1);
35-
memcpy(data, Data, Size);
36-
data[Size] = '\0';
37-
34+
3835
if (fuzzer_request_startup() == FAILURE) {
39-
free(data);
4036
return 0;
4137
}
4238

39+
char *data = malloc(Size+1);
40+
memcpy(data, Data, Size);
41+
data[Size] = '\0';
42+
4343
fuzzer_setup_dummy_frame();
4444

4545
args[0] = data;

sapi/fuzzer/fuzzer-unserialize.c

+5-5
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,15 @@
3030
#include "ext/standard/php_var.h"
3131

3232
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
33-
unsigned char *orig_data = malloc(Size+1);
34-
memcpy(orig_data, Data, Size);
35-
orig_data[Size] = '\0';
3633

37-
if (fuzzer_request_startup() == FAILURE) {
38-
free(orig_data)
34+
if (fuzzer_request_startup() == FAILURE) {
3935
return 0;
4036
}
4137

38+
unsigned char *orig_data = malloc(Size+1);
39+
memcpy(orig_data, Data, Size);
40+
orig_data[Size] = '\0';
41+
4242
fuzzer_setup_dummy_frame();
4343

4444
{

sapi/fuzzer/fuzzer-unserializehash.c

+5-6
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t FullSize) {
3434
}
3535
++Start;
3636

37-
size_t Size = (Data + FullSize) - Start;
38-
unsigned char *orig_data = malloc(Size+1);
39-
memcpy(orig_data, Start, Size);
40-
orig_data[Size] = '\0';
41-
4237
if (fuzzer_request_startup() == FAILURE) {
43-
free(orig_data);
4438
return 0;
4539
}
4640

41+
size_t Size = (Data + FullSize) - Start;
42+
unsigned char *orig_data = malloc(Size+1);
43+
memcpy(orig_data, Start, Size);
44+
orig_data[Size] = '\0';
45+
4746
fuzzer_setup_dummy_frame();
4847

4948
{

0 commit comments

Comments
 (0)