Commit 60ddc8fbf11 for php

commit 60ddc8fbf1185fe82d04c91c986b548dbb578478
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Fri Sep 25 15:33:15 2026 -0700

    JSON fuzzer: use options for handling invalid UTF-8 and big strings (#23877)

    Previously, the fuzzer only used the default options (`0`) and the
    `PHP_JSON_OBJECT_AS_ARRAY` option (`1`). After running the fuzzer on its
    existing corpus with `-reduce_inputs=0`, `-runs=100000`, and `-seed=1`, it
    failed to reach the code paths for handling big integers and strings, or for
    dealing with invalid UTF8, within the allotted 100,000 runs. Those 100,000 runs
    resulted in coverage of roughly 2,020 code blocks or edges, and roughly 5,400
    "features".

    Expand the fuzzer to also run with options that include the
    `PHP_JSON_BIGINT_AS_STRING`, `PHP_JSON_INVALID_UTF8_IGNORE`, and
    `PHP_JSON_INVALID_UTF8_SUBSTITUTE` flags. The two flags for handling UTF-8 are
    not applied used together, since invalid UTF-8 can only be handled one way, but
    other than that all combinations of these flags and `PHP_JSON_OBJECT_AS_ARRAY`
    are now tested. Repeating the same fuzzing as earlier with the expanded options
    results in roughly 2,150 code blocks or edges, and roughly 5,700 "features",
    being covered.

diff --git a/sapi/fuzzer/fuzzer-json.c b/sapi/fuzzer/fuzzer-json.c
index 5029cb9a585..0407a895835 100644
--- a/sapi/fuzzer/fuzzer-json.c
+++ b/sapi/fuzzer/fuzzer-json.c
@@ -24,6 +24,7 @@
 #include <stdlib.h>

 #include "fuzzer-sapi.h"
+#include "ext/json/php_json.h"
 #include "ext/json/php_json_parser.h"

 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
@@ -36,10 +37,25 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 	memcpy(data, Data, Size);
 	data[Size] = '\0';

-	for (int option = 0; option <=1; ++option) {
+	int options[12] = {
+		0,
+		PHP_JSON_OBJECT_AS_ARRAY,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_OBJECT_AS_ARRAY | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_BIGINT_AS_STRING,
+		PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_BIGINT_AS_STRING | PHP_JSON_INVALID_UTF8_SUBSTITUTE,
+		PHP_JSON_INVALID_UTF8_IGNORE,
+		PHP_JSON_INVALID_UTF8_SUBSTITUTE
+	};
+
+	for (int index = 0; index < 12; ++index) {
 		zval result;
 		php_json_parser parser;
-		php_json_parser_init(&parser, &result, data, Size, option, 10);
+		php_json_parser_init(&parser, &result, data, Size, options[index], 10);
 		if (php_json_yyparse(&parser) == SUCCESS) {
 			zval_ptr_dtor(&result);
 		}