Closed jvoisin closed 4 years ago
Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
:memo: Please visit https://cla.developers.google.com/ to sign.
Once you've signed (or fixed any issues), please reply here with @googlebot I signed it!
and we'll verify it.
ℹ️ Googlers: Go here for more info.
`@googlebot I signed it!
Thanks, looks cool!
A couple of notes:
Callbacks are currently unused (<fuzzfunction>
always point to phpinfo). Generating callback code in a similar manner to the main function could potentially expose additional bugs, especially if callbacks get access to the same variables / can mess up stuff that the caller didn't expect.
Currently, the return vallues from the function / method calls are ignored. In cases where function / method calls return non-trivial types, wouldn't it be better to store these return values in variables and use them as function arguments in later calls or potentially call methods on these "generated" objects?
I wanted to keep the pull-request simple. I added your suggestions (and the other items on my todo-list) in the README.md file.
Alright, merging as is for now. Thanks!
This commit was inspired (but completely rewritten) by https://blog.jmpesp.org/2020/01/fuzzing-php-with-domato.html
The php_generated.txt file was generated via parse_types.py