Fuzz introspector: fuzz_amf
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
138 9 LLVMFuzzerTestOneInput call site: 00009 brpc::SkipAMFObjectBody
6 148 LLVMFuzzerTestOneInput call site: 00148 brpc::ReadAMFShortStringBody
4 4 LLVMFuzzerTestOneInput call site: 00004 butil::IOBuf::append
3 158 LLVMFuzzerTestOneInput call site: 00158 brpc::AMFInputStream::cutn
3 163 LLVMFuzzerTestOneInput call site: 00163 brpc::AMFInputStream::cutn
2 1 LLVMFuzzerTestOneInput call site: 00001
1 156 LLVMFuzzerTestOneInput call site: 00156 brpc::AMFInputStream::cutn

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 butil::IOBuf::IOBuf [function] [call site] 00001
2 reset_block_ref [function] [call site] 00002
2 reset_block_ref [function] [call site] 00003
1 butil::IOBuf::append [function] [call site] 00004
2 butil::IOBuf::append [function] [call site] 00005
2 butil::IOBuf::length [function] [call site] 00007
3 butil::IOBuf::_small [function] [call site] 00008
1 brpc::ReadAMFObject [function] [call site] 00009
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00010
3 brpc::AMFInputStream::cutn [function] [call site] 00011
2 brpc::ReadAMFObjectBody [function] [call site] 00016
3 brpc::CheckAMFDepth [function] [call site] 00017
3 EvilService::GetDescriptor [function] [call site] 00019
3 brpc::ReadAMFShortStringBody [function] [call site] 00020
4 brpc::AMFInputStream::cut_u16 [function] [call site] 00021
5 butil::NetToHost16 [function] [call site] 00022
6 butil::ByteSwap [function] [call site] 00023
7 _byteswap_ushort [function] [call site] 00024
5 brpc::AMFInputStream::cutn [function] [call site] 00025
5 butil::NetToHost16 [function] [call site] 00026
4 brpc::CheckAMFStringSize [function] [call site] 00028
4 std::string*::resize [function] [call site] 00030
4 mcpack2pb::InputStream::cutn [function] [call site] 00031
3 std::string::empty [function] [call site] 00043
3 brpc::AMFInputStream::cut_u8 [function] [call site] 00044
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00047
3 RPC_VLOG_IF [function] [call site] 00048
3 google::protobuf::Descriptor*::full_name [function] [call site] 00049
3 brpc::ReadAMFObjectField [function] [call site] 00050
4 brpc::CheckAMFDepth [function] [call site] 00051
4 google::protobuf::Message*::GetReflection [function] [call site] 00052
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00053
4 brpc::AMFInputStream::cut_u64 [function] [call site] 00055
5 butil::NetToHost64 [function] [call site] 00056
6 butil::ByteSwap [function] [call site] 00057
5 brpc::AMFInputStream::cutn [function] [call site] 00058
5 butil::NetToHost64 [function] [call site] 00059
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00061
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00063
4 google::protobuf::Reflection*::SetDouble [function] [call site] 00064
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00065
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00067
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00069
4 brpc::AMFField::SetBool [function] [call site] 00070
5 brpc::AMFField::Clear [function] [call site] 00071
6 brpc::AMFField::SlowerClear [function] [call site] 00072
7 brpc::AMFField::type [function] [call site] 00073
4 brpc::ReadAMFShortStringBody [function] [call site] 00075
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00076
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00078
4 brpc::RedisReply::SetString [function] [call site] 00079
5 brpc::RedisReply::SetStringImpl [function] [call site] 00080
6 brpc::RedisReply::Reset [function] [call site] 00081
6 brpc::RedisReply::size [function] [call site] 00082
6 brpc::RedisReply::data [function] [call site] 00084
7 brpc::RedisReply::is_string [function] [call site] 00085
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00086
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00087
7 RedisReplyTypeToString [function] [call site] 00089
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00090
6 brpc::RedisReply::data [function] [call site] 00094
4 brpc::ReadAMFShortStringBody [function] [call site] 00095
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00097
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00099
4 google::protobuf::Reflection*::MutableMessage [function] [call site] 00100
4 brpc::ReadAMFObjectBody [function] [call site] 00101
4 brpc::SkipAMFObjectBody [function] [call site] 00102
5 brpc::CheckAMFDepth [function] [call site] 00103
5 brpc::ReadAMFShortStringBody [function] [call site] 00104
5 std::string::empty [function] [call site] 00105
5 brpc::AMFInputStream::cut_u8 [function] [call site] 00106
5 brpc::ReadAMFObjectField [function] [call site] 00109
4 brpc::marker2str [function] [call site] 00111
4 brpc::ReadAMFLongStringBody [function] [call site] 00113
5 brpc::AMFInputStream::cut_u32 [function] [call site] 00114
6 butil::NetToHost32 [function] [call site] 00115
7 butil::ByteSwap [function] [call site] 00116
6 brpc::AMFInputStream::cutn [function] [call site] 00117
6 butil::NetToHost32 [function] [call site] 00118
5 brpc::CheckAMFStringSize [function] [call site] 00120
5 std::string*::resize [function] [call site] 00121
5 mcpack2pb::InputStream::cutn [function] [call site] 00122
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00126
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00128
4 brpc::RedisReply::SetString [function] [call site] 00129
2 brpc::ReadAMFEcmaArrayBody [function] [call site] 00130
3 brpc::CheckAMFDepth [function] [call site] 00131
3 brpc::AMFInputStream::cut_u32 [function] [call site] 00132
3 brpc::CheckAMFArraySize [function] [call site] 00134
3 EvilService::GetDescriptor [function] [call site] 00136
3 brpc::ReadAMFShortStringBody [function] [call site] 00137
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00139
3 RPC_VLOG_IF [function] [call site] 00140
3 google::protobuf::Descriptor*::full_name [function] [call site] 00141
3 brpc::ReadAMFObjectField [function] [call site] 00142
2 brpc::marker2str [function] [call site] 00144
2 brpc::RedisRequest::IsInitialized [function] [call site] 00145
2 brpc::NonreflectableMessage::InitializationErrorString [function] [call site] 00147
1 brpc::ReadAMFString [function] [call site] 00148
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00149
2 brpc::ReadAMFShortStringBody [function] [call site] 00151
2 brpc::ReadAMFLongStringBody [function] [call site] 00152
2 brpc::marker2str [function] [call site] 00154
1 brpc::AMFInputStream::good [function] [call site] 00155
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00156
2 brpc::AMFInputStream::cutn [function] [call site] 00157
1 brpc::AMFInputStream::cut_u64 [function] [call site] 00158
2 butil::NetToHost64 [function] [call site] 00159
2 brpc::AMFInputStream::cutn [function] [call site] 00160
2 butil::NetToHost64 [function] [call site] 00161
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00162
1 brpc::AMFInputStream::cut_u16 [function] [call site] 00163
2 butil::NetToHost16 [function] [call site] 00164
2 brpc::AMFInputStream::cutn [function] [call site] 00165
2 butil::NetToHost16 [function] [call site] 00166
1 brpc::AMFInputStream::cutn [function] [call site] 00167