Fuzz introspector: FuzzCUPS
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 119 119 cups_globals_alloc call site: 00110 /src/cups/cups/globals.c:195
0 0 None 10 16 _cupsStrScand call site: 00155 /src/cups/cups/string.c:407
0 0 None 6 6 _cupsStrScand call site: 00157 /src/cups/cups/string.c:444
0 0 None 0 395 _cupsRasterExecPS call site: 00003 /src/cups/cups/raster-interpret.c:523
0 0 None 0 395 _cupsRasterExecPS call site: 00140 /src/cups/cups/raster-interpret.c:529
0 0 None 0 6 copy_stack call site: 00184 /src/cups/cups/raster-interpret.c:730
0 0 None 0 0 cups_globals_alloc call site: 00117 /src/cups/cups/globals.c:349
0 0 None 0 0 _cupsRasterAddError call site: 00138 /src/cups/cups/raster-error.c:43
0 0 None 0 0 _cupsRasterAddError call site: 00138 /src/cups/cups/raster-error.c:50
0 0 None 0 0 _cupsRasterAddError call site: 00139 /src/cups/cups/raster-error.c:70
0 0 None 0 0 push_stack call site: 00176 /src/cups/cups/raster-interpret.c:944
0 0 None 0 0 new_stack call site: 00141 /src/cups/cups/raster-interpret.c:894

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 calloc [call site] 00001
1 _cupsRasterExecPS [function] [call site] 00002
2 strdup [call site] 00003
2 _cupsRasterAddError [function] [call site] 00004
3 _cupsGlobals [function] [call site] 00005
4 pthread_once [call site] 00006
4 cups_globals_init [function] [call site] 00007
5 pthread_key_create [call site] 00008
5 cups_globals_free [function] [call site] 00009
6 _cupsStrFree [function] [call site] 00010
7 _cupsMutexLock [function] [call site] 00011
8 pthread_mutex_lock [call site] 00012
7 cupsArrayFind [function] [call site] 00013
8 cups_array_find [function] [call site] 00014
7 cupsArrayRemove [function] [call site] 00015
8 cups_array_find [function] [call site] 00016
7 _cupsMutexUnlock [function] [call site] 00017
8 pthread_mutex_unlock [call site] 00018
6 cupsArrayDelete [function] [call site] 00019
6 cupsArrayDelete [function] [call site] 00020
6 cupsArrayDelete [function] [call site] 00021
6 httpClose [function] [call site] 00022
7 _httpDisconnect [function] [call site] 00023
8 _httpTLSStop [function] [call site] 00024
9 SSL_get_SSL_CTX [call site] 00025
9 SSL_shutdown [call site] 00026
9 SSL_CTX_free [call site] 00027
9 SSL_free [call site] 00028
8 httpAddrClose [function] [call site] 00029
9 close [call site] 00030
9 unlink [call site] 00031
7 httpAddrFreeList [function] [call site] 00032
7 httpClearFields [function] [call site] 00033
8 httpSetField [function] [call site] 00034
9 http_add_field [function] [call site] 00035
10 strchr [call site] 00036
10 strchr [call site] 00037
10 snprintf [call site] 00038
10 _cups_strlcpy [function] [call site] 00039
11 strlen [call site] 00040
10 strlen [call site] 00041
10 strlen [call site] 00042
10 strlen [call site] 00043
10 snprintf [call site] 00044
10 _cups_strlcpy [function] [call site] 00045
10 snprintf [call site] 00046
10 realloc [call site] 00047
10 _cups_strlcat [function] [call site] 00048
11 strlen [call site] 00049
11 strlen [call site] 00050
10 _cups_strlcat [function] [call site] 00051
10 strdup [call site] 00052
10 http_content_coding_start [function] [call site] 00053
11 strcmp [call site] 00054
11 strcmp [call site] 00055
11 httpFlushWrite [function] [call site] 00056
12 http_write_chunk [function] [call site] 00057
13 snprintf [call site] 00058
13 strlen [call site] 00059
13 http_write [function] [call site] 00060
14 poll [call site] 00061
14 __errno_location [call site] 00062
14 __errno_location [call site] 00063
14 _httpTLSWrite [function] [call site] 00064
15 SSL_write [call site] 00065
14 send [call site] 00066
14 __errno_location [call site] 00067
14 __errno_location [call site] 00068
14 __errno_location [call site] 00069
14 __errno_location [call site] 00070
14 __errno_location [call site] 00071
14 __errno_location [call site] 00072
13 http_write [function] [call site] 00073
13 http_write [function] [call site] 00074
12 http_write [function] [call site] 00075
11 __errno_location [call site] 00076
11 calloc [call site] 00077
11 __errno_location [call site] 00078
11 deflateInit2_ [call site] 00079
11 __errno_location [call site] 00080
11 calloc [call site] 00081
11 __errno_location [call site] 00082
11 inflateInit2_ [call site] 00083
8 httpSetField [function] [call site] 00084
6 _httpFreeCredentials [function] [call site] 00085
7 X509_free [call site] 00086
6 cupsFileClose [function] [call site] 00087
7 cupsFileFlush [function] [call site] 00088
8 cups_compress [function] [call site] 00089
9 crc32 [call site] 00090
9 cups_write [function] [call site] 00091
10 send [call site] 00092
10 write [call site] 00093
10 __errno_location [call site] 00094
9 deflate [call site] 00095
8 cups_write [function] [call site] 00096
7 inflateEnd [call site] 00097
7 cups_write [function] [call site] 00098
7 deflate [call site] 00099
7 cups_write [function] [call site] 00100
7 deflateEnd [call site] 00101
7 httpAddrClose [function] [call site] 00102
7 close [call site] 00103
6 cupsFileClose [function] [call site] 00104
6 cupsFreeOptions [function] [call site] 00105
7 _cupsStrFree [function] [call site] 00106
7 _cupsStrFree [function] [call site] 00107
4 pthread_getspecific [call site] 00108
4 cups_globals_alloc [function] [call site] 00109
5 calloc [call site] 00110
5 geteuid [call site] 00111
5 getenv [call site] 00112
5 getenv [call site] 00113
5 getenv [call site] 00114
5 getenv [call site] 00115
5 getenv [call site] 00116
5 getenv [call site] 00117
5 getuid [call site] 00118
5 _cupsStrAlloc [function] [call site] 00119
6 _cupsMutexLock [function] [call site] 00120
6 cupsArrayNew [function] [call site] 00121
7 cupsArrayNew3 [function] [call site] 00122
8 calloc [call site] 00123
6 compare_sp_items [function] [call site] 00124
7 strcmp [call site] 00125
6 _cupsMutexUnlock [function] [call site] 00126
6 cupsArrayFind [function] [call site] 00127
6 _cupsMutexUnlock [function] [call site] 00128
6 strlen [call site] 00129
6 calloc [call site] 00130
6 _cupsMutexUnlock [function] [call site] 00131
6 cupsArrayAdd [function] [call site] 00132
7 cups_array_add [function] [call site] 00133
8 realloc [call site] 00134
8 cups_array_find [function] [call site] 00135
6 _cupsMutexUnlock [function] [call site] 00136
4 pthread_setspecific [call site] 00137
3 vsnprintf [call site] 00138
3 realloc [call site] 00139
2 new_stack [function] [call site] 00140
3 calloc [call site] 00141
3 calloc [call site] 00142
2 _cupsRasterAddError [function] [call site] 00143
2 scan_ps [function] [call site] 00144
3 __ctype_b_loc [call site] 00145
3 __ctype_b_loc [call site] 00146
3 tolower [call site] 00147
3 __ctype_b_loc [call site] 00148
3 tolower [call site] 00149
3 __ctype_b_loc [call site] 00150
3 __ctype_b_loc [call site] 00151
3 atoi [call site] 00152
3 strchr [call site] 00153
3 localeconv [call site] 00154
3 _cupsStrScand [function] [call site] 00155
4 _cups_isspace [function] [call site] 00156
4 __ctype_b_loc [call site] 00157
4 _cups_strlcpy [function] [call site] 00158
4 strlen [call site] 00159
4 __ctype_b_loc [call site] 00160
4 __ctype_b_loc [call site] 00161
4 atof [call site] 00162
3 strchr [call site] 00163
3 strcmp [call site] 00164
3 strcmp [call site] 00165
3 strcmp [call site] 00166
3 strcmp [call site] 00167
3 strcmp [call site] 00168
3 strcmp [call site] 00169
3 strcmp [call site] 00170
3 strcmp [call site] 00171
3 strcmp [call site] 00172
3 strcmp [call site] 00173
3 strcmp [call site] 00174
3 push_stack [function] [call site] 00175
4 realloc [call site] 00176
2 pop_stack [function] [call site] 00177
2 cleartomark_stack [function] [call site] 00178
3 pop_stack [function] [call site] 00179
2 _cupsRasterAddError [function] [call site] 00180
2 pop_stack [function] [call site] 00181
2 pop_stack [function] [call site] 00182
2 copy_stack [function] [call site] 00183
3 push_stack [function] [call site] 00184
2 pop_stack [function] [call site] 00185
2 copy_stack [function] [call site] 00186
2 pop_stack [function] [call site] 00187
2 pop_stack [function] [call site] 00188
2 index_stack [function] [call site] 00189
3 push_stack [function] [call site] 00190
2 pop_stack [function] [call site] 00191
2 pop_stack [function] [call site] 00192
2 pop_stack [function] [call site] 00193
2 pop_stack [function] [call site] 00194
2 pop_stack [function] [call site] 00195
2 roll_stack [function] [call site] 00196
3 calloc [call site] 00197
3 calloc [call site] 00198
2 pop_stack [function] [call site] 00199
2 setpagedevice [function] [call site] 00200
3 strcmp [call site] 00201
3 _cups_strlcpy [function] [call site] 00202
3 strcmp [call site] 00203
3 _cups_strlcpy [function] [call site] 00204
3 strcmp [call site] 00205
3 _cups_strlcpy [function] [call site] 00206
3 strcmp [call site] 00207
3 _cups_strlcpy [function] [call site] 00208
3 strcmp [call site] 00209
3 strcmp [call site] 00210
3 strcmp [call site] 00211
3 strcmp [call site] 00212
3 strcmp [call site] 00213
3 strcmp [call site] 00214
3 strcmp [call site] 00215
3 strcmp [call site] 00216
3 strcmp [call site] 00217
3 strcmp [call site] 00218
3 strcmp [call site] 00219
3 strcmp [call site] 00220
3 strcmp [call site] 00221
3 strcmp [call site] 00222
3 strcmp [call site] 00223
3 strcmp [call site] 00224
3 strcmp [call site] 00225
3 strcmp [call site] 00226
3 strcmp [call site] 00227
3 strcmp [call site] 00228
3 strcmp [call site] 00229
3 strcmp [call site] 00230
3 strcmp [call site] 00231
3 strcmp [call site] 00232
3 strcmp [call site] 00233
3 strcmp [call site] 00234
3 strcmp [call site] 00235
3 strcmp [call site] 00236
3 strcmp [call site] 00237
3 strcmp [call site] 00238
3 strcmp [call site] 00239
3 strcmp [call site] 00240
3 strncmp [call site] 00241
3 atoi [call site] 00242
3 strncmp [call site] 00243
3 atoi [call site] 00244
3 strncmp [call site] 00245
3 atoi [call site] 00246
3 _cups_strlcpy [function] [call site] 00247
3 strcmp [call site] 00248
3 _cups_strlcpy [function] [call site] 00249
3 strcmp [call site] 00250
3 _cups_strlcpy [function] [call site] 00251
3 strcmp [call site] 00252
3 _cups_strlcpy [function] [call site] 00253
2 pop_stack [function] [call site] 00254
2 _cupsRasterAddError [function] [call site] 00255
2 error_stack [function] [call site] 00256
3 _cupsRasterAddError [function] [call site] 00257
3 error_object [function] [call site] 00258
4 _cupsRasterAddError [function] [call site] 00259
4 _cupsRasterAddError [function] [call site] 00260
4 _cupsRasterAddError [function] [call site] 00261
4 _cupsRasterAddError [function] [call site] 00262
4 _cupsRasterAddError [function] [call site] 00263
4 _cupsRasterAddError [function] [call site] 00264
4 _cupsRasterAddError [function] [call site] 00265
4 _cupsRasterAddError [function] [call site] 00266
4 _cupsRasterAddError [function] [call site] 00267
4 _cupsRasterAddError [function] [call site] 00268
4 _cupsRasterAddError [function] [call site] 00269
4 _cupsRasterAddError [function] [call site] 00270
4 _cupsRasterAddError [function] [call site] 00271
4 _cupsRasterAddError [function] [call site] 00272
4 _cupsRasterAddError [function] [call site] 00273
4 _cupsRasterAddError [function] [call site] 00274
4 _cupsRasterAddError [function] [call site] 00275
4 _cupsRasterAddError [function] [call site] 00276
4 _cupsRasterAddError [function] [call site] 00277
4 _cupsRasterAddError [function] [call site] 00278
4 _cupsRasterAddError [function] [call site] 00279
3 _cupsRasterAddError [function] [call site] 00280
2 delete_stack [function] [call site] 00281
2 delete_stack [function] [call site] 00282