Fuzz introspector: croaring_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2 2 1 :

['roaring_realloc']

4 6 run_container_grow call site /src/croaring/src/containers/run.c:193
0 2 1 :

['roaring_free']

0 2 array_container_create_given_capacity call site /src/croaring/src/containers/array.c:41
0 2 1 :

['roaring_free']

0 2 bitset_container_create call site /src/croaring/src/containers/bitset.c:59
0 0 None 16 363 ra_portable_deserialize call site /src/croaring/src/roaring_array.c:757
0 0 None 2 35 ra_portable_deserialize call site /src/croaring/src/roaring_array.c:802
0 0 None 2 35 ra_portable_deserialize call site /src/croaring/src/roaring_array.c:831
0 0 None 2 35 ra_portable_deserialize call site /src/croaring/src/roaring_array.c:852
0 0 None 2 4 run_container_grow call site /src/croaring/src/containers/run.c:200
0 0 None 0 0 roaring_bitmap_set_copy_on_write call site /src/croaring/include/roaring/roaring.h:81
0 0 None 0 0 array_container_create_given_capacity call site /src/croaring/src/containers/array.c:39

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 roaring_bitmap_portable_deserialize_safe [function] [call site] 00001
2 roaring_malloc [function] [call site] 00002
2 ra_portable_deserialize [function] [call site] 00003
3 fwrite [call site] 00004
3 fprintf [call site] 00005
3 fwrite [call site] 00006
3 fprintf [call site] 00007
3 fprintf [call site] 00008
3 fwrite [call site] 00009
3 fwrite [call site] 00010
3 ra_init_with_capacity [function] [call site] 00011
4 roaring_malloc [function] [call site] 00013
3 fwrite [call site] 00014
3 fwrite [call site] 00015
3 ra_clear [function] [call site] 00016
4 ra_clear_containers [function] [call site] 00017
5 container_free [function] [call site] 00018
6 bitset_container_free [function] [call site] 00019
7 roaring_aligned_free [function] [call site] 00020
7 roaring_free [function] [call site] 00021
6 array_container_free [function] [call site] 00022
7 roaring_free [function] [call site] 00023
7 roaring_free [function] [call site] 00024
6 run_container_free [function] [call site] 00025
7 roaring_free [function] [call site] 00026
7 roaring_free [function] [call site] 00027
6 shared_container_free [function] [call site] 00028
7 container_free [function] [call site] 00029
7 roaring_free [function] [call site] 00030
4 ra_clear_without_containers [function] [call site] 00031
5 roaring_free [function] [call site] 00032
3 fwrite [call site] 00033
3 bitset_container_create [function] [call site] 00035
4 roaring_malloc [function] [call site] 00036
4 roaring_aligned_malloc [function] [call site] 00037
4 roaring_free [function] [call site] 00038
4 bitset_container_clear [function] [call site] 00039
3 fwrite [call site] 00040
3 bitset_container_read [function] [call site] 00042
3 fwrite [call site] 00043
3 fwrite [call site] 00045
3 run_container_create [function] [call site] 00047
4 run_container_create_given_capacity [function] [call site] 00048
5 roaring_malloc [function] [call site] 00049
5 roaring_malloc [function] [call site] 00050
5 roaring_free [function] [call site] 00051
3 fwrite [call site] 00052
3 run_container_read [function] [call site] 00054
4 run_container_grow [function] [call site] 00055
5 roaring_realloc [function] [call site] 00056
5 roaring_free [function] [call site] 00057
5 roaring_free [function] [call site] 00058
5 roaring_malloc [function] [call site] 00059
5 fwrite [call site] 00060
4 run_container_size_in_bytes [function] [call site] 00061
5 run_container_serialized_size_in_bytes [function] [call site] 00062
3 fwrite [call site] 00063
3 array_container_create_given_capacity [function] [call site] 00065
4 roaring_malloc [function] [call site] 00066
4 roaring_malloc [function] [call site] 00067
4 roaring_free [function] [call site] 00068
3 fwrite [call site] 00069
3 array_container_read [function] [call site] 00071
4 array_container_grow [function] [call site] 00072
5 grow_capacity [function] [call site] 00073
5 roaring_realloc [function] [call site] 00074
5 roaring_free [function] [call site] 00075
5 roaring_free [function] [call site] 00076
5 roaring_malloc [function] [call site] 00077
5 fwrite [call site] 00078
4 array_container_size_in_bytes [function] [call site] 00079
2 roaring_bitmap_set_copy_on_write [function] [call site] 00080
2 roaring_free [function] [call site] 00081
1 roaring_bitmap_free [function] [call site] 00082
2 is_frozen [function] [call site] 00083
2 roaring_free [function] [call site] 00085