Fuzz introspector: fuzz_amf
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
138 9 LLVMFuzzerTestOneInput call site: 00009 brpc::SkipAMFObjectBody
6 148 LLVMFuzzerTestOneInput call site: 00148 brpc::ReadAMFShortStringBody
4 4 LLVMFuzzerTestOneInput call site: 00004 butil::IOBuf::append
3 158 LLVMFuzzerTestOneInput call site: 00158 brpc::AMFInputStream::cutn
3 163 LLVMFuzzerTestOneInput call site: 00163 brpc::AMFInputStream::cutn
2 1 LLVMFuzzerTestOneInput call site: 00001
1 156 LLVMFuzzerTestOneInput call site: 00156 brpc::AMFInputStream::cutn

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 butil::IOBuf::IOBuf [function] [call site] 00001
2 reset_block_ref [function] [call site] 00002
2 reset_block_ref [function] [call site] 00003
1 butil::IOBuf::append [function] [call site] 00004
2 butil::IOBuf::append [function] [call site] 00005
2 butil::IOBuf::length [function] [call site] 00007
3 butil::IOBuf::_small [function] [call site] 00008
1 brpc::ReadAMFObject [function] [call site] 00009
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00010
3 brpc::AMFInputStream::cutn [function] [call site] 00011
2 brpc::ReadAMFObjectBody [function] [call site] 00016
3 brpc::CheckAMFDepth [function] [call site] 00017
3 EvilService::GetDescriptor [function] [call site] 00019
3 brpc::ReadAMFShortStringBody [function] [call site] 00020
4 brpc::AMFInputStream::cut_u16 [function] [call site] 00021
5 butil::NetToHost16 [function] [call site] 00022
6 butil::ByteSwap [function] [call site] 00023
7 _byteswap_ushort [function] [call site] 00024
5 brpc::AMFInputStream::cutn [function] [call site] 00025
5 butil::NetToHost16 [function] [call site] 00026
4 brpc::CheckAMFStringSize [function] [call site] 00028
3 std::string::empty [function] [call site] 00046
3 brpc::AMFInputStream::cut_u8 [function] [call site] 00047
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00050
3 RPC_VLOG_IF [function] [call site] 00051
3 google::protobuf::Descriptor*::full_name [function] [call site] 00052
3 brpc::ReadAMFObjectField [function] [call site] 00053
4 brpc::CheckAMFDepth [function] [call site] 00054
4 google::protobuf::Message*::GetReflection [function] [call site] 00055
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00056
4 brpc::AMFInputStream::cut_u64 [function] [call site] 00058
5 butil::NetToHost64 [function] [call site] 00059
6 butil::ByteSwap [function] [call site] 00060
5 brpc::AMFInputStream::cutn [function] [call site] 00061
5 butil::NetToHost64 [function] [call site] 00062
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00064
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00066
4 google::protobuf::Reflection*::SetDouble [function] [call site] 00067
4 brpc::AMFInputStream::cut_u8 [function] [call site] 00068
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00070
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00072
4 brpc::AMFField::SetBool [function] [call site] 00073
5 brpc::AMFField::Clear [function] [call site] 00074
6 brpc::AMFField::SlowerClear [function] [call site] 00075
7 brpc::AMFField::type [function] [call site] 00076
4 brpc::ReadAMFShortStringBody [function] [call site] 00078
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00079
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00081
4 brpc::RedisReply::SetString [function] [call site] 00082
5 brpc::RedisReply::SetStringImpl [function] [call site] 00083
6 brpc::RedisReply::Reset [function] [call site] 00084
6 brpc::RedisReply::size [function] [call site] 00085
6 brpc::RedisReply::data [function] [call site] 00087
7 brpc::RedisReply::is_string [function] [call site] 00088
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00089
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00090
7 RedisReplyTypeToString [function] [call site] 00092
7 butil::BasicStringPiece::BasicStringPiece [function] [call site] 00093
6 brpc::RedisReply::data [function] [call site] 00097
4 brpc::ReadAMFShortStringBody [function] [call site] 00098
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00100
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00102
4 google::protobuf::Reflection*::MutableMessage [function] [call site] 00103
4 brpc::ReadAMFObjectBody [function] [call site] 00104
4 brpc::SkipAMFObjectBody [function] [call site] 00105
5 brpc::CheckAMFDepth [function] [call site] 00106
5 brpc::ReadAMFShortStringBody [function] [call site] 00107
5 std::string::empty [function] [call site] 00108
5 brpc::AMFInputStream::cut_u8 [function] [call site] 00109
5 brpc::ReadAMFObjectField [function] [call site] 00112
4 brpc::marker2str [function] [call site] 00114
4 brpc::ReadAMFLongStringBody [function] [call site] 00116
5 brpc::AMFInputStream::cut_u32 [function] [call site] 00117
6 butil::NetToHost32 [function] [call site] 00118
7 butil::ByteSwap [function] [call site] 00119
6 brpc::AMFInputStream::cutn [function] [call site] 00120
6 butil::NetToHost32 [function] [call site] 00121
5 brpc::CheckAMFStringSize [function] [call site] 00123
5 brpc::ReadAMFStringData [function] [call site] 00124
4 google::protobuf::FieldDescriptor*::cpp_type [function] [call site] 00126
4 google::protobuf::FieldDescriptor*::full_name [function] [call site] 00128
4 brpc::RedisReply::SetString [function] [call site] 00129
2 brpc::ReadAMFEcmaArrayBody [function] [call site] 00130
3 brpc::CheckAMFDepth [function] [call site] 00131
3 brpc::AMFInputStream::cut_u32 [function] [call site] 00132
3 brpc::CheckAMFArraySize [function] [call site] 00134
3 EvilService::GetDescriptor [function] [call site] 00136
3 brpc::ReadAMFShortStringBody [function] [call site] 00137
3 google::protobuf::Descriptor*::FindFieldByName [function] [call site] 00139
3 RPC_VLOG_IF [function] [call site] 00140
3 google::protobuf::Descriptor*::full_name [function] [call site] 00141
3 brpc::ReadAMFObjectField [function] [call site] 00142
2 brpc::marker2str [function] [call site] 00144
2 brpc::RedisRequest::IsInitialized [function] [call site] 00145
2 brpc::NonreflectableMessage::InitializationErrorString [function] [call site] 00147
1 brpc::ReadAMFString [function] [call site] 00148
2 brpc::AMFInputStream::cut_u8 [function] [call site] 00149
2 brpc::ReadAMFShortStringBody [function] [call site] 00151
2 brpc::ReadAMFLongStringBody [function] [call site] 00152
2 brpc::marker2str [function] [call site] 00154
1 brpc::AMFInputStream::good [function] [call site] 00155
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00156
2 brpc::AMFInputStream::cutn [function] [call site] 00157
1 brpc::AMFInputStream::cut_u64 [function] [call site] 00158
2 butil::NetToHost64 [function] [call site] 00159
2 brpc::AMFInputStream::cutn [function] [call site] 00160
2 butil::NetToHost64 [function] [call site] 00161
1 brpc::AMFInputStream::cut_u8 [function] [call site] 00162
1 brpc::AMFInputStream::cut_u16 [function] [call site] 00163
2 butil::NetToHost16 [function] [call site] 00164
2 brpc::AMFInputStream::cutn [function] [call site] 00165
2 butil::NetToHost16 [function] [call site] 00166
1 brpc::AMFInputStream::cutn [function] [call site] 00167