Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104853
Sender: Michael Wallner <mike.php.net@gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>,
 PHP Internals <internals@lists.php.net>, "security@php.net"
 <security@php.net>
References: <a73c84cb-efe3-507e-1a0d-1967e1521e50@gmail.com>
Openpgp: preference=signencrypt
Autocrypt: addr=mike@php.net; prefer-encrypt=mutual; keydata=
 mQENBFDcYVsBCADZmu3ac2q1H+Tz8S3XrNQGs+TBHRBpEsafPQBn6wpdMdJ/GDeSYxwoItoy
 jLWmg8cc45SWLYHzU3gkcSgljoivYnwbLbEZnCqE1V//oQYaMIAcQvO6nnGHWcFN6WyRl6wl
 3K866fYmwzE+H2JymjIY0YBdV7/oXDRUNrGaF7C7XAjY13sI0Uq8BV/q6J3e0xTQw+VAaf6X
 7mQvQjIgNipTe44ozVPEJSfNpUzPn2uV8ancWru6dmtm3fZZkGUcxNhXsVsEX7R1iHNWBuXS
 qsKmi5KViWbajg6juha/rbQd2b05PxJGH6ctGyMeU9ubJqIoVBpHeGyuGaizcv98686NABEB
 AAG0JU1pY2hhZWwgV2FsbG5lciAobTZ3NikgPG1pa2VAcGhwLm5ldD6JATcEEwEIACEFAla0
 mo8CGwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQSA4+FLCkx8dRVAf/a1POvRGQnpIj
 hB6AplnFUx3GaIUlrTiUkZMyhftfk7Wgr3b+X4UitoVTaBm6Zsd8wPCwL2T5fD1B3QBq6N+G
 RscCzOq87Co6ZmrLApBTqv89MvF8sCGGuXhKpAClLbe9Un9GFunbrnJk21Q6AqJVeIFSYPQ/
 LmPaAJ3oFifdPyI8W8OFB5GnkH7JImvFr/vH90zm0rt5hSwdpuV5PxxbcCZkAuVw/8OZ+Zup
 WBqwo9keLTzaGuzLNtruP62OXuwKuaryw80eWfZn5SxI41NVjoSLfDeoBdFarFtQFJUyEEXp
 uA4LED/aYxKbvTIZxTn/zC2mrheKn5iLKmJQjVCz67kBDQRQ3GFbAQgAxmWfmElDtz7IzOOH
 TWl3/vLih1dARzgJSv62v2mkQwcb9UyMmM5ZDyYZw36ZFoSyrcDxUipWfLk3wiV9+dqOidBH
 aVVJ9Oub15FZE0i4wkHPColkvEGCrwxWBSLQouYet9YzeWR/CzODylUPNDOWWqyOAT+2A68t
 jbRIQDONJhrqJPY+DWZinEewE8FxAFgcjCPGG512vTPmbg7OnWGWs1oORTFerAMWyNfxYdph
 MVad8b0uLX3csUXF+XVCQcwEwxfmiuDDYULmqYcDskbnG1lDBfpEngRZIbQ4ml15jhocc4Sv
 QnPKtNqBX6k3PWd/qdjk5JG8X9vYZDrG11BewQARAQABiQEfBBgBAgAJBQJQ3GFbAhsMAAoJ
 EEgOPhSwpMfHtwYIALi5sLY7FO2oiTihyHLeJXleV+2uP69KgoZdhdp8M/wOAc6bGr3L2wEK
 lF1lcCJAZBqgm6rPX8HFWgiH8FIgJEaR2ecOt+FNLqR0DKXTm785dpjHxQFOGbVM2zK+BsD9
 Xnput34d9NcXhyOeABhi3eIJUATWY210OyC9siEGipBIK0eLnbFlaUOt83L75yn7TD58LSmh
 /Sp3GGFprmNL+5WrSyl1uy7bo+1qi4nOWikFL31lahQ4Zs73ST9GeTbd+wLDqSvHD/GP9Z8Y
 8jNw+niBhKOLvFFrP7EUTchqjR36xPosf/MnqdETRiaV9c+J762X7vzwFazSCbAZ5h8CIL4=
Message-ID: <420ce5d1-a64e-6578-11e3-851bc2ee0637@php.net>
Date: Thu, 21 Mar 2019 14:49:58 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <a73c84cb-efe3-507e-1a0d-1967e1521e50@gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="pnjbKENRTcEK2m5uZXuy9M2tbf4v4ONbz"
Subject: Re: [PHP-DEV] PHP on OSS-fuzz
From: mike@php.net (Michael Wallner)

--pnjbKENRTcEK2m5uZXuy9M2tbf4v4ONbz
Content-Type: multipart/mixed; boundary="AACBZ3mq9TtzbaYgyDE9x6WUPPY6bUlTJ";
 protected-headers="v1"
From: Michael Wallner <mike@php.net>
To: Stanislav Malyshev <smalyshev@gmail.com>,
 PHP Internals <internals@lists.php.net>, "security@php.net"
 <security@php.net>
Message-ID: <420ce5d1-a64e-6578-11e3-851bc2ee0637@php.net>
Subject: Re: [PHP-DEV] PHP on OSS-fuzz
References: <a73c84cb-efe3-507e-1a0d-1967e1521e50@gmail.com>
In-Reply-To: <a73c84cb-efe3-507e-1a0d-1967e1521e50@gmail.com>

--AACBZ3mq9TtzbaYgyDE9x6WUPPY6bUlTJ
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: quoted-printable

Hey!

On 17/03/2019 22:23, Stanislav Malyshev wrote:
> Hi!
>=20
> Looking at the recent PHP security issues, it is clear that many of the=
m
> are stemming from corner cases in various format-parsing code, and most=

> of them either is or can be found by fuzzers.
>=20
> Thus, I've made an initial integration for PHP on OSS-fuzz project - a
> fuzzing engine for testing open source projects. PHP configuration sits=

> here:
> https://github.com/google/oss-fuzz/tree/master/projects/php

I followed the progress on github. Thanks for doing the work up front.

> and implementation of fuzzers is here:
> https://github.com/php/php-fuzzing-sapi
>=20
> So far we have three fuzzers enabled: JSON, EXIF and mbstring. I plan
> also to add basic phar fuzzer soon. Everybody is welcome to add more
> fuzzers - with priority on ones that actually deal with third-party
> data, e.g. language parser fuzzer is not enabled right now, because
> people usually do not run random byte streams as PHP scripts on their
> servers. On the other hand, people do apply EXIF or gd functions to
> third-party data, so a vulnerability in that code would be high priorit=
y.
>=20
> That said, fuzzers can be run independently of OSS-Fuzz, so if you feel=

> inspired to add a fuzzer for any code please do so.
>=20

I hope I'll find time to try it out soon, thanks again!


--=20
Regards,
Mike


--AACBZ3mq9TtzbaYgyDE9x6WUPPY6bUlTJ--

--pnjbKENRTcEK2m5uZXuy9M2tbf4v4ONbz
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEHsPHHd1jWDGjN9aESA4+FLCkx8cFAlyTlocACgkQSA4+FLCk
x8f7jgf+KZwq7utF1agwtEjQFXBWBnSQt6qRW5cy93ddxuUZgJ52ZB1Gjg5B5WqK
dgqCdIT9SIlsdWApmpZ4CXtpK+l/WUku3D9Di7u7VWPfONcIRZS/kImKyky3tkLy
lsUXzaeoI9w+fE6mqs9akaa3Gf5lQEt+ixW0rqxgRusFfS57MN8KipC99eQndAym
vB7xIkX1QaJmvARaJheYhyzR8kljlEM6pkJFQm61RvJyXzvxpX1MWoTA/62uxZEq
9iXyJUYJrK0kYki2vSV73vFIg5kZClYyUW6Ptsl2z6htVBNYkhuptDqlO+KvzOjg
Am0StwMfpO24LFbziOhXAjt2TF0wYg==
=sv73
-----END PGP SIGNATURE-----

--pnjbKENRTcEK2m5uZXuy9M2tbf4v4ONbz--