JSON fuzzer: use options for handling invalid UTF-8 and big strings (#23877)

Previously, the fuzzer only used the default options (`0`) and the
`PHP_JSON_OBJECT_AS_ARRAY` option (`1`). After running the fuzzer on its
existing corpus with `-reduce_inputs=0`, `-runs=100000`, and `-seed=1`, it
failed to reach the code paths for handling big integers and strings, or for
dealing with invalid UTF8, within the allotted 100,000 runs. Those 100,000 runs
resulted in coverage of roughly 2,020 code blocks or edges, and roughly 5,400
"features".

Expand the fuzzer to also run with options that include the
`PHP_JSON_BIGINT_AS_STRING`, `PHP_JSON_INVALID_UTF8_IGNORE`, and
`PHP_JSON_INVALID_UTF8_SUBSTITUTE` flags. The two flags for handling UTF-8 are
not applied used together, since invalid UTF-8 can only be handled one way, but
other than that all combinations of these flags and `PHP_JSON_OBJECT_AS_ARRAY`
are now tested. Repeating the same fuzzing as earlier with the expanded options
results in roughly 2,150 code blocks or edges, and roughly 5,700 "features",
being covered.

Author: DanielEScherzer

sapi/fuzzer/fuzzer-json.c

@@ -24,6 +24,7 @@
 #include <stdlib.h>
 
 #include "fuzzer-sapi.h"
+#include "ext/json/php_json.h"
 #include "ext/json/php_json_parser.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
@@ -36,10 +37,25 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 	memcpy(data, Data, Size);
 	data[Size] = '\0';
 
-	for (int option = 0; option <=1; ++option) {
+	int options[12] = {
+		0,
+		PHP_JSON_OBJECT_AS_ARRAY,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_BIGINT_AS_STRING,
+		PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_INVALID_UTF8_SUBSTITUTE
+	};
+
+	for (int index = 0; index < 12; ++index) {
 		zval result;
 		php_json_parser parser;
-		php_json_parser_init(&parser, &result, data, Size, option, 10);
+		php_json_parser_init(&parser, &result, data, Size, options[index], 10);
 		if (php_json_yyparse(&parser) == SUCCESS) {
 			zval_ptr_dtor(&result);
 		}