Fuzz introspector: cjson_read_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2 2 1 :

['strcpy']

2 16 print_string_ptr call site: 00031 /src/cjson/cJSON.c:917
0 0 None 0 202 print_object call site: 00042 /src/cjson/cJSON.c:1759
0 0 None 0 202 print_object call site: 00046 /src/cjson/cJSON.c:1779
0 0 None 0 139 print_array call site: 00038 /src/cjson/cJSON.c:1564
0 0 None 0 105 cJSON_PrintBuffered call site: 00010 /src/cjson/cJSON.c:1272
0 0 None 0 18 cJSON_ParseWithLengthOpts call site: 00003 /src/cjson/cJSON.c:1104
0 0 None 0 18 cJSON_ParseWithLengthOpts call site: 00004 /src/cjson/cJSON.c:1115
0 0 None 0 18 parse_array call site: 00000 /src/cjson/cJSON.c:1452
0 0 None 0 18 parse_array call site: 00000 /src/cjson/cJSON.c:1480
0 0 None 0 18 parse_object call site: 00000 /src/cjson/cJSON.c:1638
0 0 None 0 6 print call site: 00055 /src/cjson/cJSON.c:1206
0 0 None 0 0 cJSON_ParseWithOpts call site: 00001 /src/cjson/cJSON.c:1083

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 cJSON_ParseWithOpts [function] [call site] 00001
2 strlen [call site] 00002
2 cJSON_ParseWithLengthOpts [function] [call site] 00003
3 cJSON_New_Item [function] [call site] 00004
3 skip_utf8_bom [function] [call site] 00005
4 strncmp [call site] 00006
3 buffer_skip_whitespace [function] [call site] 00007
3 cJSON_Delete [function] [call site] 00008
4 cJSON_Delete [function] [call site] 00009
1 cJSON_PrintBuffered [function] [call site] 00010
2 print_value [function] [call site] 00011
3 strcpy [call site] 00013
3 strcpy [call site] 00015
3 strcpy [call site] 00017
3 print_number [function] [call site] 00018
4 get_decimal_point [function] [call site] 00019
5 localeconv [call site] 00020
4 sprintf [call site] 00021
4 sprintf [call site] 00022
4 sprintf [call site] 00023
4 __isoc99_sscanf [call site] 00024
4 compare_double [function] [call site] 00025
4 sprintf [call site] 00026
3 strlen [call site] 00028
3 print_string [function] [call site] 00030
4 print_string_ptr [function] [call site] 00031
5 strcpy [call site] 00033
5 sprintf [call site] 00035
1 cJSON_Print [function] [call site] 00053
2 print [function] [call site] 00054
3 print_value [function] [call site] 00055
3 update_offset [function] [call site] 00056
1 cJSON_PrintUnformatted [function] [call site] 00057
1 cJSON_Minify [function] [call site] 00059
2 skip_oneline_comment [function] [call site] 00060
2 skip_multiline_comment [function] [call site] 00061
2 minify_string [function] [call site] 00062
1 cJSON_Delete [function] [call site] 00063