Limit parse depth in mbstring fuzzer

The default depth of 4096 is large enough to cause optimize_node
stack overflows under asan. Reduce to 1024.

diff --git a/sapi/fuzzer/fuzzer-mbstring.c b/sapi/fuzzer/fuzzer-mbstring.c
index 3ec0c42c4e5802b420549e807b595e9c0aee88e1..5821024ec39a4b391a8f56c4020c0c08db679458 100644 (file)
--- a/sapi/fuzzer/fuzzer-mbstring.c
+++ b/sapi/fuzzer/fuzzer-mbstring.c
@@ -20,6 +20,7 @@
 #include "Zend/zend.h"
 #include "main/php_config.h"
 #include "main/php_main.h"
+#include "oniguruma.h"
 
 #include <stdio.h>
 #include <stdint.h>
@@ -67,6 +68,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 int LLVMFuzzerInitialize(int *argc, char ***argv) {
        fuzzer_init_php();
 
+       /* The default parse depth limit allows stack overflows under asan. */
+       onig_set_parse_depth_limit(1024);
+
        /* fuzzer_shutdown_php(); */
        return 0;
 }