https://github.com/googleprojectzero/domato- 1.
[name] has [number] [adjective] [noun]s.
[name]'s [noun] is very [adjective].
I want to purchase [number] [adjective] [noun]s.
- 1.
- 2.
- 3.
Names: alice, bob, eve
Numbers: 1, 10, 100
Adjectives: green, large, expensive
Nouns: car, hat, laptop
- 1.
- 2.
- 3.
- 4.
eve has 1 expensive laptops.
alice's hat is very green.
I want to purchase 100 expensive cars.
I want to purchase 10 large laptops.
bob has 100 expensive cars.
eve has 100 green laptops.
I want to purchase 100 large laptops.
bob has 1 large cars.
I want to purchase 1 large cars.
I want to purchase 1 large hats.
bob's laptop is very expensive.
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
if (var0 == var5) { int var5 = 915941154; } else { int var3 = 1848395349; }; if (var3 == -121615885) { int var7 = 1962369640;; int var1 = 196553597;;; int var6 = -263472135;; } else { int var2 == 563276937; };
while (var9 = var8) { while (var0 == -2029947247) { int var7 = 1879609559; } }; char var0 = '';;
char var2 = '/';
char var3 = 'P';
if (var8 == var1) { int var7 = -306701547; } else { while (var3 == 868601407) { while (var0 == -1328592927) { char var10 = '^'; }; char var8 = 'L';;; int var9 = -1345514425;; char var5 = 'b';;; } }
int var8 = 882574440;
if (var8 == var9) { int var7 = 1369926086; } else { if (var9 != -442302103) { if (var3 != 386704757) { while (var4 != -264413007) { char var6 = 'C'; } } else { int var8 = 289431268; } } else { char var10 = '~'; } }
char var5 = '+';
if (var9 == 1521038703) { char var2 = '&'; } else { int var7 = -215672117; }
while (var9 == var0) { char var9 = 'X';; int var7 = -1463788903;; }; if (var8 == var7) { int var10 = 1664850687;; char var6 = 'f';; } else { while (var5 == -187795546) { int var3 = -1287471401; } };
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
andrew@thinkpad /tmp % php lang.php
zend_version();
func_num_args();
func_get_arg(arg_num);
func_get_args();
strlen(str);
strcmp(str1, str2);
strncmp(str1, str2, len);
strcasecmp(str1, str2);
strncasecmp(str1, str2, len);
each(arr);
error_reporting(new_error_level);
define(constant_name, value, case_insensitive);
defined(constant_name);
get_class(object);
... etc ...
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
https://www.php.net/manual/en/reflectionparameter.gettype.php- 1.
https://www.php.net/distributions/manual/php_manual_en.html.gz- 1.
andrew@thinkpad ~/domato/php % python generator.py /dev/stdout
Writing a sample to /dev/stdout
<?php
$vars = array(
"stdClass" => new stdClass(),
"Exception" => new Exception(),
"ErrorException" => new ErrorException(),
"Error" => new Error(),
"CompileError" => new CompileError(),
"ParseError" => new ParseError(),
"TypeError" => new TypeError(),
... etc ...
);
try { try { $vars["SplPriorityQueue"]->insert(false, array("a" => 1, "b" => "2", "c" => 3.0)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { filter_has_var(1000, str_repeat("%s%x%n", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { posix_access(implode(array_map(function($c) {return "\\x" . str_pad(dechex($c), 2, "0");}, range(0, 255))), -1); } catch (Exception $e) { } } catch(Error $e) { }
try { try { rand(0, 0); } catch (Exception $e) { } } catch(Error $e) { }
try { try { fputcsv(fopen("/dev/null", "r"), array("a" => 1, "b" => "2", "c" => 3.0), str_repeat(chr(135), 65), str_repeat(chr(193), 17) + str_repeat(chr(21), 65537), str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { $vars["ReflectionMethod"]->isAbstract(); } catch (Exception $e) { } } catch(Error $e) { }
try { try { $vars["DOMProcessingInstruction"]->__construct(str_repeat(chr(122), 17) + str_repeat(chr(49), 65537) + str_repeat(chr(235), 257), str_repeat(chr(138), 65) + str_repeat(chr(45), 4097) + str_repeat(chr(135), 65)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { utf8_encode(str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { $vars["MultipleIterator"]->current(); } catch (Exception $e) { } } catch(Error $e) { }
try { try { dl(str_repeat("A", 0x100)); } catch (Exception $e) { } } catch(Error $e) { }
try { try { ignore_user_abort(true); } catch (Exception $e) { } } catch(Error $e) { }
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
https://github.com/google/sanitizers/wiki/AddressSanitizer- 1.
https://www.php.net/downloads
- 1.
./configure CFLAGS="-fsanitize=address -ggdb" CXXFLAGS="-fsanitize=address -ggdb" LDFLAGS="-fsanitize=address"
make
make install
- 1.
- 2.
- 3.
$class_blacklist = array(
// Can't actually instantiate
"Closure",
"Generator",
"HashContext",
"RecursiveIteratorIterator",
"IteratorIterator",
"FilterIterator",
"RecursiveFilterIterator",
"CallbackFilterIterator",
"RecursiveCallbackFilterIterator",
"ParentIterator",
"LimitIterator",
"CachingIterator",
"RecursiveCachingIterator",
"NoRewindIterator",
"AppendIterator",
"InfiniteIterator",
"RegexIterator",
"RecursiveRegexIterator",
"EmptyIterator",
"RecursiveTreeIterator",
"ArrayObject",
"ArrayIterator",
"RecursiveArrayIterator",
"SplFileInfo",
"DirectoryIterator",
"FilesystemIterator",
"RecursiveDirectoryIterator",
"GlobIterator",
);
$function_blacklist = array(
"exit", // false positives
"readline", // pauses
"readline_callback_handler_install", // pauses
"syslog", // spams syslog
"sleep", // pauses
"usleep", // pauses
"time_sleep_until", // pauses
"time_nanosleep", // pauses
"pcntl_wait", // pauses
"pcntl_waitstatus", // pauses
"pcntl_waitpid", // pauses
"pcntl_sigwaitinfo", // pauses
"pcntl_sigtimedwait", // pauses
"stream_socket_recvfrom", // pauses
"posix_kill", // ends own process
"ereg", // cpu dos
"eregi", // cpu dos
"eregi_replace", // cpu dos
"ereg_replace", // cpu dos
"similar_text", // cpu dos
"snmpwalk", // cpu dos
"snmpwalkoid", // cpu dos
"snmpget", // cpu dos
"split", // cpu dos
"spliti", // cpu dos
"snmpgetnext", // cpu dos
"mcrypt_create_iv", // cpu dos
"gmp_fact", // cpu dos
"posix_setrlimit"
);
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32.
- 33.
- 34.
- 35.
- 36.
- 37.
- 38.
- 39.
- 40.
- 41.
- 42.
- 43.
- 44.
- 45.
- 46.
- 47.
- 48.
- 49.
- 50.
- 51.
- 52.
- 53.
- 54.
- 55.
- 56.
- 57.
- 58.
- 59.
- 60.
- 61.
- 62.
- 63.
https://bugs.php.net/bug.php?id=79029- 1.
本文翻译自：https://blog.jmpesp.org/2020/01/fuzzing-php-with-domato.html?m=1&fbclid=IwAR16VPIISd2dERbma9o5bmYrEo-iBS7gPhsr0UqjUJWLlctWiHO1zpmPjHg如若转载，请注明原文地址。
