Fuzz introspector: xml_parser_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
135 1703 13 :

['reportComment', 'doCdataSection', 'memcmp', 'poolClear', 'freeBindings', 'XmlUtf8Encode', 'lookup', 'reportDefault', 'processInternalEntity', 'reportProcessingInstruction', 'getContext', 'poolStoreString', 'storeAtts']

135 1833 doContent call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:2999
135 1703 13 :

['reportComment', 'doCdataSection', 'memcmp', 'poolClear', 'freeBindings', 'XmlUtf8Encode', 'lookup', 'reportDefault', 'processInternalEntity', 'reportProcessingInstruction', 'getContext', 'poolStoreString', 'storeAtts']

135 1833 doContent call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:3060
7 73 3 :

['poolStoreString', 'normalizeLines', 'poolClear']

7 73 reportProcessingInstruction call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:6146
7 42 3 :

['poolStoreString', 'normalizeLines', 'poolClear']

7 42 reportComment call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:6171
4 4 2 :

['strtoul', '__errno_location']

4 4 getDebugLevel call site: 00016 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:8241
0 180 2 :

['lookup', 'poolGrow']

0 180 getAttributeId call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:6344
0 124 1 :

['little2_prologTok']

0 124 initScan call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmltok.c:1625
0 34 1 :

['XML_ParserFree']

0 34 parserCreate call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:1068
0 0 None 574 1148 cdataSectionProcessor call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:3869
0 0 None 135 1833 doContent call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:2831
0 0 None 135 1833 doContent call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:2853
0 0 None 135 1833 doContent call site: 00000 /src/CMake/Utilities/cmexpat/lib/xmlparse.c:2865

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fopen [call site] 00001
1 fwrite [call site] 00002
1 fclose [call site] 00003
1 cmXMLParser::cmXMLParser() [function] [call site] 00004
1 cmXMLParser::ParseFile(char const*) [function] [call site] 00005
1 cmXMLParser::~cmXMLParser() [function] [call site] 00006
2 cmXMLParser::CleanupParser() [function] [call site] 00007
3 XML_Parse [function] [call site] 00008
4 startParsing [function] [call site] 00009
5 generate_hash_secret_salt [function] [call site] 00010
6 writeRandomBytes_getrandom_nonblock [function] [call site] 00011
7 getrandom [call site] 00012
7 __errno_location [call site] 00013
6 ENTROPY_DEBUG [function] [call site] 00014
7 getDebugLevel [function] [call site] 00015
8 getenv [call site] 00016
8 __errno_location [call site] 00017
8 strtoul [call site] 00018
7 fprintf [call site] 00019
6 writeRandomBytes_dev_urandom [function] [call site] 00020
7 open [call site] 00021
7 read [call site] 00022
7 __errno_location [call site] 00023
7 close [call site] 00024
6 ENTROPY_DEBUG [function] [call site] 00025
6 gather_time_entropy [function] [call site] 00026
7 gettimeofday [call site] 00027
6 getpid [call site] 00028
6 ENTROPY_DEBUG [function] [call site] 00029
5 setContext [function] [call site] 00030
6 poolGrow [function] [call site] 00031
7 poolBytesToAllocateFor [function] [call site] 00032
7 poolBytesToAllocateFor [function] [call site] 00033
6 lookup [function] [call site] 00034
7 hash [function] [call site] 00035
8 copy_salt_to_sipkey [function] [call site] 00036
9 get_hash_secret_salt [function] [call site] 00037
8 sip24_init [function] [call site] 00038
8 keylen [function] [call site] 00039
8 sip24_update [function] [call site] 00040
9 sip_round [function] [call site] 00041
8 sip24_final [function] [call site] 00042
9 sip_round [function] [call site] 00043
9 sip_round [function] [call site] 00044
7 hash [function] [call site] 00045
7 keyeq [function] [call site] 00046
7 hash [function] [call site] 00047
6 poolGrow [function] [call site] 00048
6 lookup [function] [call site] 00049
6 poolCopyString [function] [call site] 00050
7 poolGrow [function] [call site] 00051
6 poolGrow [function] [call site] 00052
6 poolGrow [function] [call site] 00053
6 addBinding [function] [call site] 00054
6 poolGrow [function] [call site] 00055
4 XML_GetBuffer [function] [call site] 00056
4 XML_ParseBuffer [function] [call site] 00057
5 startParsing [function] [call site] 00058
3 XML_ParserFree [function] [call site] 00059
4 destroyBindings [function] [call site] 00060
4 destroyBindings [function] [call site] 00061
4 destroyBindings [function] [call site] 00062
4 poolDestroy [function] [call site] 00063
4 poolDestroy [function] [call site] 00064
4 dtdDestroy [function] [call site] 00065
5 hashTableIterInit [function] [call site] 00066
5 hashTableIterNext [function] [call site] 00067
5 hashTableDestroy [function] [call site] 00068
5 hashTableDestroy [function] [call site] 00069
5 hashTableDestroy [function] [call site] 00070
5 hashTableDestroy [function] [call site] 00071
5 poolDestroy [function] [call site] 00072
5 poolDestroy [function] [call site] 00073
2 __clang_call_terminate [call site] 00074
3 __cxa_begin_catch [call site] 00075
1 remove [call site] 00076