Fuzz introspector: fuzz_amf
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
132 9 LLVMFuzzerTestOneInput call site: 00009 brpc::SkipAMFObjectBody
6 142 LLVMFuzzerTestOneInput call site: 00142 brpc::ReadAMFShortStringBody
4 4 LLVMFuzzerTestOneInput call site: 00004 butil::IOBuf::append
3 152 LLVMFuzzerTestOneInput call site: 00152 brpc::AMFInputStream::cutn
3 157 LLVMFuzzerTestOneInput call site: 00157 brpc::AMFInputStream::cutn
2 1 LLVMFuzzerTestOneInput call site: 00001
1 150 LLVMFuzzerTestOneInput call site: 00150 brpc::AMFInputStream::cutn

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 butil::IOBuf::IOBuf [function] [call site] 00001
2 reset_block_ref [function] [call site] 00002
2 reset_block_ref [function] [call site] 00003
1 butil::IOBuf::append [function] [call site] 00004
2 butil::IOBuf::append [function] [call site] 00005
2 butil::IOBuf::length [function] [call site] 00007
3 butil::IOBuf::_small [function] [call site] 00008
1 brpc::ReadAMFObject [function] [call site] 00009
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00010
3 brpc::AMFInputStream::cutn [function] [call site] 00011
2 brpc::ReadAMFObjectBody [function] [call site] 00016
3 brpc::CheckAMFDepth [function] [call site] 00017
3 EvilService::GetDescriptor [function] [call site] 00019
3 brpc::ReadAMFShortStringBody [function] [call site] 00020
4 brpc::AMFInputStream::cut_u16 [function] [call site] 00021
5 butil::NetToHost16 [function] [call site] 00022
6 butil::ByteSwap [function] [call site] 00023
7 _byteswap_ushort [function] [call site] 00024
5 brpc::AMFInputStream::cutn [function] [call site] 00025
5 butil::NetToHost16 [function] [call site] 00026
4 brpc::CheckAMFStringSize [function] [call site] 00028
4 std::string*::resize [function] [call site] 00030
4 mcpack2pb::InputStream::cutn [function] [call site] 00031
4 std::string*::clear [function] [call site] 00035
3 std::string::empty [function] [call site] 00037
3 brpc::AMFInputStream::cut_u8 [function] [call site] 00038
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00041
3 RPC_VLOG_IF [function] [call site] 00042
3 google::protobuf::Descriptor*::full_name [function] [call site] 00043
3 brpc::ReadAMFObjectField [function] [call site] 00044
4 brpc::CheckAMFDepth [function] [call site] 00045
4 google::protobuf::Message*::GetReflection [function] [call site] 00046
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00047
4 brpc::AMFInputStream::cut_u64 [function] [call site] 00049
5 butil::NetToHost64 [function] [call site] 00050
6 butil::ByteSwap [function] [call site] 00051
5 brpc::AMFInputStream::cutn [function] [call site] 00052
5 butil::NetToHost64 [function] [call site] 00053
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00055
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00057
4 google::protobuf::Reflection*::SetDouble [function] [call site] 00058
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00059
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00061
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00063
4 brpc::AMFField::SetBool [function] [call site] 00064
5 brpc::AMFField::Clear [function] [call site] 00065
6 brpc::AMFField::SlowerClear [function] [call site] 00066
7 brpc::AMFField::type [function] [call site] 00067
4 brpc::ReadAMFShortStringBody [function] [call site] 00069
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00070
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00072
4 brpc::RedisReply::SetString [function] [call site] 00073
5 brpc::RedisReply::SetStringImpl [function] [call site] 00074
6 brpc::RedisReply::Reset [function] [call site] 00075
6 brpc::RedisReply::size [function] [call site] 00076
6 brpc::RedisReply::data [function] [call site] 00078
7 brpc::RedisReply::is_string [function] [call site] 00079
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00080
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00081
7 RedisReplyTypeToString [function] [call site] 00083
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00084
6 brpc::RedisReply::data [function] [call site] 00088
4 brpc::ReadAMFShortStringBody [function] [call site] 00089
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00091
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00093
4 google::protobuf::Reflection*::MutableMessage [function] [call site] 00094
4 brpc::ReadAMFObjectBody [function] [call site] 00095
4 brpc::SkipAMFObjectBody [function] [call site] 00096
5 brpc::CheckAMFDepth [function] [call site] 00097
5 brpc::ReadAMFShortStringBody [function] [call site] 00098
5 std::string::empty [function] [call site] 00099
5 brpc::AMFInputStream::cut_u8 [function] [call site] 00100
5 brpc::ReadAMFObjectField [function] [call site] 00103
4 brpc::marker2str [function] [call site] 00105
4 brpc::ReadAMFLongStringBody [function] [call site] 00107
5 brpc::AMFInputStream::cut_u32 [function] [call site] 00108
6 butil::NetToHost32 [function] [call site] 00109
7 butil::ByteSwap [function] [call site] 00110
6 brpc::AMFInputStream::cutn [function] [call site] 00111
6 butil::NetToHost32 [function] [call site] 00112
5 brpc::CheckAMFStringSize [function] [call site] 00114
5 std::string*::resize [function] [call site] 00115
5 mcpack2pb::InputStream::cutn [function] [call site] 00116
5 std::string*::clear [function] [call site] 00117
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00120
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00122
4 brpc::RedisReply::SetString [function] [call site] 00123
2 brpc::ReadAMFEcmaArrayBody [function] [call site] 00124
3 brpc::CheckAMFDepth [function] [call site] 00125
3 brpc::AMFInputStream::cut_u32 [function] [call site] 00126
3 brpc::CheckAMFArraySize [function] [call site] 00128
3 EvilService::GetDescriptor [function] [call site] 00130
3 brpc::ReadAMFShortStringBody [function] [call site] 00131
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00133
3 RPC_VLOG_IF [function] [call site] 00134
3 google::protobuf::Descriptor*::full_name [function] [call site] 00135
3 brpc::ReadAMFObjectField [function] [call site] 00136
2 brpc::marker2str [function] [call site] 00138
2 brpc::RedisRequest::IsInitialized [function] [call site] 00139
2 brpc::NonreflectableMessage::InitializationErrorString [function] [call site] 00141
1 brpc::ReadAMFString [function] [call site] 00142
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00143
2 brpc::ReadAMFShortStringBody [function] [call site] 00145
2 brpc::ReadAMFLongStringBody [function] [call site] 00146
2 brpc::marker2str [function] [call site] 00148
1 brpc::AMFInputStream::good [function] [call site] 00149
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00150
2 brpc::AMFInputStream::cutn [function] [call site] 00151
1 brpc::AMFInputStream::cut_u64 [function] [call site] 00152
2 butil::NetToHost64 [function] [call site] 00153
2 brpc::AMFInputStream::cutn [function] [call site] 00154
2 butil::NetToHost64 [function] [call site] 00155
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00156
1 brpc::AMFInputStream::cut_u16 [function] [call site] 00157
2 butil::NetToHost16 [function] [call site] 00158
2 brpc::AMFInputStream::cutn [function] [call site] 00159
2 butil::NetToHost16 [function] [call site] 00160
1 brpc::AMFInputStream::cutn [function] [call site] 00161