Fuzz introspector: cgif_rgb_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
46 46 1 :

['doWidthHeightOptim']

46 132 flushFrame call site: 00072 /src/cgif/build/../src/cgif.c:382
2 5 2 :

['fclose', 'freeCGIF']

2 5 cgif_newgif call site: 00012 /src/cgif/build/../src/cgif.c:121
2 2 1 :

['fopen64']

6 31 cgif_newgif call site: 00009 /src/cgif/build/../src/cgif.c:83
2 2 1 :

['memcmp']

2 145 cgif_addframe call site: 00068 /src/cgif/build/../src/cgif.c:499
2 2 1 :

['fclose']

2 9 cgif_close call site: 00110 /src/cgif/build/../src/cgif.c:606
2 2 1 :

['fwrite']

2 2 writecb call site: 00000 /src/cgif/build/../src/cgif.c:53
0 16 3 :

['malloc', 'cmpPixel', 'calcNextPower2Ex']

0 86 flushFrame call site: 00073 /src/cgif/build/../src/cgif.c:397
0 3 2 :

['writeDummyBytes', 'calcNextPower2Ex.61']

0 7 cgif_raw_newgif call site: 00013 /src/cgif/build/../src/cgif_raw.c:444
0 0 None 46 132 flushFrame call site: 00072 /src/cgif/build/../src/cgif.c:377
0 0 1 :

['malloc']

2 27 cgif_newgif call site: 00011 /src/cgif/build/../src/cgif.c:103
0 0 None 2 12 cgif_close call site: 00109 /src/cgif/build/../src/cgif.c:591
0 0 None 2 2 cgif_newgif call site: 00010 /src/cgif/build/../src/cgif.c:91

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 processInput(ByteStream*) [function] [call site] 00001
2 read_gifconfig(ByteStream*, st_cgif_rgb_config*) [function] [call site] 00002
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00003
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00004
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00005
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00006
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00007
2 cgif_rgb_newgif [function] [call site] 00008
3 cgif_newgif [function] [call site] 00009
4 fopen64 [call site] 00010
4 fclose [call site] 00011
4 cgif_raw_newgif [function] [call site] 00012
5 initMainHeader [function] [call site] 00013
6 calcNextPower2Ex [function] [call site] 00016
5 calcNextPower2Ex [function] [call site] 00017
5 writeDummyBytes [function] [call site] 00018
5 initAppExtBlock [function] [call site] 00019
4 fclose [call site] 00021
2 read_frameconfig(ByteStream*, st_cgif_rgb_frameconfig*, unsigned long) [function] [call site] 00023
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00024
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00025
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00026
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00027
3 readdata(ByteStream*, void*, unsigned long) [function] [call site] 00028
2 cgif_rgb_addframe [function] [call site] 00029
3 get_color_histogram [function] [call site] 00030
4 init_col_hash_table [function] [call site] 00031
5 getNextPrimePower2 [function] [call site] 00032
4 col_hash_collision_count [function] [call site] 00033
5 getPixelVal [function] [call site] 00034
5 memcmp [call site] 00035
4 resize_col_hash_table [function] [call site] 00036
5 getNextPrimePower2 [function] [call site] 00037
5 realloc [call site] 00038
5 realloc [call site] 00039
5 col_hash [function] [call site] 00040
6 getPixelVal [function] [call site] 00041
6 memcmp [call site] 00042
3 quantize_and_dither [function] [call site] 00043
4 hash_to_dense [function] [call site] 00044
4 create_decision_tree [function] [call site] 00046
5 new_tree_node [function] [call site] 00047
6 get_variance [function] [call site] 00048
5 crawl_decision_tree [function] [call site] 00051
6 new_tree_node [function] [call site] 00052
6 new_tree_node [function] [call site] 00053
5 get_palette_from_decision_tree [function] [call site] 00054
6 get_palette_from_decision_tree [function] [call site] 00055
7 get_palette_from_decision_tree [function] [call site] 00056
4 get_quantized_dithered_image [function] [call site] 00057
5 get_leave_node_index [function] [call site] 00058
6 get_leave_node_index [function] [call site] 00059
7 get_leave_node_index [function] [call site] 00060
5 get_leave_node_index [function] [call site] 00061
4 free_decision_tree [function] [call site] 00062
5 free_decision_tree [function] [call site] 00063
6 free_decision_tree [function] [call site] 00064
4 memcmp [call site] 00065
3 free_col_hash_table [function] [call site] 00067
3 cgif_addframe [function] [call site] 00068
4 memcmp [call site] 00069
4 cmpPixel [function] [call site] 00070
5 memcmp [call site] 00071
4 flushFrame [function] [call site] 00072
5 doWidthHeightOptim [function] [call site] 00073
6 getDiffAreaGlobalPalette [function] [call site] 00074
7 memcmp [call site] 00075
7 memcmp [call site] 00076
5 calcNextPower2Ex [function] [call site] 00082
5 cgif_raw_addframe [function] [call site] 00084
6 calcNextPower2Ex [function] [call site] 00085
6 calcInitCodeLen [function] [call site] 00086
7 calcNextPower2Ex [function] [call site] 00087
6 LZW_GenerateStream [function] [call site] 00092
7 lzw_generate [function] [call site] 00093
8 resetDict [function] [call site] 00094
8 lzw_crawl_tree [function] [call site] 00095
7 create_byte_list [function] [call site] 00099
7 create_byte_list_block [function] [call site] 00100
6 LZW_GenerateStream [function] [call site] 00101
6 writeDummyBytes [function] [call site] 00103
4 freeFrame [function] [call site] 00104
4 copyFrameConfig [function] [call site] 00105
2 read_frameconfig(ByteStream*, st_cgif_rgb_frameconfig*, unsigned long) [function] [call site] 00106
2 cgif_rgb_close [function] [call site] 00107
3 cgif_close [function] [call site] 00108
4 flushFrame [function] [call site] 00109
4 cgif_raw_close [function] [call site] 00110
4 fclose [call site] 00111
4 freeFrame [function] [call site] 00112