Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Fuzzing the PHP Interpreter via Dataflow Fusion

Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland Yap, Zhenkai Liang

TL;DR

FlowFusion tackles memory errors in the PHP interpreter by fusing high-quality official tests through dataflow interleaving to generate semantically richer inputs. It augments fusion with test mutation, interface fuzzing, and environment crossover, guided by a sanitizer oracle and delta debugging to produce reproducible bugs. In large-scale evaluation, FlowFusion discovers 158 unknown memory bugs (125 fixed, 11 confirmed), surpasses the official test suite and test-concatenation in code coverage, and outperforms AFL++ and Polyglot in 24-hour fuzzing, earning integration into the PHP toolchain. The work demonstrates practical benefits for hardening the PHP runtime and suggests that dataflow-based test fusion can generalize to other language runtimes.

Abstract

PHP, a dominant scripting language in web development, powers a vast range of websites, from personal blogs to major platforms. While existing research primarily focuses on PHP application-level security issues like code injection, memory errors within the PHP interpreter have been largely overlooked. These memory errors, prevalent due to the PHP interpreter's extensive C codebase, pose significant risks to the confidentiality, integrity, and availability of PHP servers. This paper introduces FlowFusion, the first automatic fuzzing framework to detect memory errors in the PHP interpreter. FlowFusion leverages dataflow as an efficient representation of test cases maintained by PHP developers, merging two or more test cases to produce fused test cases with more complex code semantics. Moreover, FlowFusion employs strategies such as test mutation, interface fuzzing, and environment crossover to increase bug finding. In our evaluation, FlowFusion found 158 unknown bugs in the PHP interpreter, with 125 fixed and 11 confirmed. Comparing FlowFusion against the official test suite and a naive test concatenation approach, FlowFusion can detect new bugs that these methods miss, while also achieving greater code coverage. FlowFusion also outperformed state-of-the-art fuzzers AFL++ and Polyglot, covering 24% more lines of code after 24 hours of fuzzing. FlowFusion has gained wide recognition among PHP developers and is now integrated into the official PHP toolchain.

Fuzzing the PHP Interpreter via Dataflow Fusion

TL;DR

FlowFusion tackles memory errors in the PHP interpreter by fusing high-quality official tests through dataflow interleaving to generate semantically richer inputs. It augments fusion with test mutation, interface fuzzing, and environment crossover, guided by a sanitizer oracle and delta debugging to produce reproducible bugs. In large-scale evaluation, FlowFusion discovers 158 unknown memory bugs (125 fixed, 11 confirmed), surpasses the official test suite and test-concatenation in code coverage, and outperforms AFL++ and Polyglot in 24-hour fuzzing, earning integration into the PHP toolchain. The work demonstrates practical benefits for hardening the PHP runtime and suggests that dataflow-based test fusion can generalize to other language runtimes.

Abstract

PHP, a dominant scripting language in web development, powers a vast range of websites, from personal blogs to major platforms. While existing research primarily focuses on PHP application-level security issues like code injection, memory errors within the PHP interpreter have been largely overlooked. These memory errors, prevalent due to the PHP interpreter's extensive C codebase, pose significant risks to the confidentiality, integrity, and availability of PHP servers. This paper introduces FlowFusion, the first automatic fuzzing framework to detect memory errors in the PHP interpreter. FlowFusion leverages dataflow as an efficient representation of test cases maintained by PHP developers, merging two or more test cases to produce fused test cases with more complex code semantics. Moreover, FlowFusion employs strategies such as test mutation, interface fuzzing, and environment crossover to increase bug finding. In our evaluation, FlowFusion found 158 unknown bugs in the PHP interpreter, with 125 fixed and 11 confirmed. Comparing FlowFusion against the official test suite and a naive test concatenation approach, FlowFusion can detect new bugs that these methods miss, while also achieving greater code coverage. FlowFusion also outperformed state-of-the-art fuzzers AFL++ and Polyglot, covering 24% more lines of code after 24 hours of fuzzing. FlowFusion has gained wide recognition among PHP developers and is now integrated into the official PHP toolchain.

Paper Structure

This paper contains 16 sections, 3 equations, 4 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Threat Model
  4. Approach
  5. Approach Overview
  6. Dataflow Fusion
  7. Further Strategies
  8. Implementation
  9. Evaluation
  10. Discovering Unknown Memory Errors
  11. Improvement on Official Test Suite
  12. Comparison with Existing Approaches
  13. Ablation Study
  14. Discussion
  15. Related Work
  16. ...and 1 more sections

Figures (4)

  • Figure 1: Approach Overview --- Illustrated with Segfault Error Found by FlowFusion in the Zend Engine
  • Figure 2: Code Coverage over Test Suite and Concatenation
  • Figure 3: Coverage Comparison against AFL++ and Polyglot
  • Figure 4: Ablation Study of FlowFusion