From 451106f802a06efd01def037aec1d61c2fe9cfb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= Date: Sat, 15 Aug 2026 11:04:07 +0200 Subject: [PATCH] fuzz: disable Zend's arena allocator under go-118-fuzz-build Zend's own arena allocator reuses freed memory in ways that hide bugs from ASan/MSan; disabling it (USE_ZEND_ALLOC=0) is already required for the sanitizer CI jobs (.github/workflows/sanitizers.yaml), but that env var never reaches a libFuzzer binary built by OSS-Fuzz: build.sh runs in a throwaway build container, and ClusterFuzz later execs the compiled fuzzer as a fresh process on a different bot with no inherited env. The libFuzzer .options file can't fill the gap either, since ClusterFuzz whitelists its [env] section down to two unrelated variables. Setting it from an init() gated on the "gofuzz" build tag reaches the process before PHP starts, without touching any non-fuzzing build. --- zendalloc_gofuzz.go | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 zendalloc_gofuzz.go diff --git a/zendalloc_gofuzz.go b/zendalloc_gofuzz.go new file mode 100644 index 0000000000..e9267bcb97 --- /dev/null +++ b/zendalloc_gofuzz.go @@ -0,0 +1,10 @@ +//go:build gofuzz + +package frankenphp + +import "os" + +func init() { + // Zend's own arena allocator hides bugs from the sanitizers OSS-Fuzz builds with. + os.Setenv("USE_ZEND_ALLOC", "0") +}