Fuzz introspector: fuzz_array
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2 2 1 :

['realloc']

2 19 cups_array_add call site: 00019 /src/cups/cups/array.c:1030
0 0 None 2 2 cupsArrayDup call site: 00043 /src/cups/cups/array.c:296
0 0 None 0 40 cupsArrayAdd call site: 00018 /src/cups/cups/array.c:78
0 0 None 0 17 cupsArrayFind call site: 00038 /src/cups/cups/array.c:363
0 0 None 0 17 cupsArrayFind call site: 00038 /src/cups/cups/array.c:367
0 0 None 0 17 cupsArrayFind call site: 00038 /src/cups/cups/array.c:371
0 0 None 0 17 cupsArrayRemove call site: 00045 /src/cups/cups/array.c:897
0 0 None 0 17 cupsArrayRemove call site: 00045 /src/cups/cups/array.c:901
0 0 None 0 17 cups_array_add call site: 00020 /src/cups/cups/array.c:1047
0 0 None 0 17 cups_array_add call site: 00020 /src/cups/cups/array.c:1059
0 0 None 0 6 cupsArrayGetFirst call site: 00025 /src/cups/cups/array.c:507
0 0 None 0 6 cupsArrayGetLast call site: 00032 /src/cups/cups/array.c:562

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 generate_fuzz_array_data [function] [call site] 00001
2 strcpy [call site] 00002
2 strcpy [call site] 00003
2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() [call site] 00004
1 cupsArrayNew3 [function] [call site] 00005
2 calloc [call site] 00006
1 _cupsArrayStrcmp [function] [call site] 00007
2 strcmp [call site] 00008
1 _cupsArrayStrdup [function] [call site] 00009
2 strdup [call site] 00010
1 _cupsArrayFree [function] [call site] 00011
1 printf [call site] 00012
1 abort [call site] 00013
1 cupsArrayGetUserData [function] [call site] 00014
1 cupsArrayGetUserData [function] [call site] 00015
1 printf [call site] 00016
1 abort [call site] 00017
1 cupsArrayAdd [function] [call site] 00018
2 cups_array_add [function] [call site] 00019
3 realloc [call site] 00020
3 cups_array_find [function] [call site] 00021
1 printf [call site] 00022
1 abort [call site] 00023
1 cupsArrayGetCount [function] [call site] 00024
1 cupsArrayGetFirst [function] [call site] 00025
2 cupsArrayCurrent [function] [call site] 00026
3 cupsArrayGetCurrent [function] [call site] 00027
1 printf [call site] 00028
1 cupsArrayGetNext [function] [call site] 00029
2 cupsArrayCurrent [function] [call site] 00030
1 printf [call site] 00031
1 cupsArrayGetLast [function] [call site] 00032
2 cupsArrayCurrent [function] [call site] 00033
1 printf [call site] 00034
1 cupsArrayGetPrev [function] [call site] 00035
2 cupsArrayCurrent [function] [call site] 00036
1 printf [call site] 00037
1 cupsArrayFind [function] [call site] 00038
2 cups_array_find [function] [call site] 00039
1 printf [call site] 00040
1 cupsArrayGetCurrent [function] [call site] 00041
1 printf [call site] 00042
1 cupsArrayDup [function] [call site] 00043
2 calloc [call site] 00044
1 cupsArrayRemove [function] [call site] 00045
2 cups_array_find [function] [call site] 00046
1 printf [call site] 00047
1 cupsArrayClear [function] [call site] 00048
1 cupsArrayGetCount [function] [call site] 00049
1 printf [call site] 00050
1 cupsArrayGetFirst [function] [call site] 00051
1 cupsArraySave [function] [call site] 00052
1 cupsArrayGetNext [function] [call site] 00053
1 cupsArrayRestore [function] [call site] 00054
1 cupsArrayDelete [function] [call site] 00055
1 cupsArrayDelete [function] [call site] 00056
1 abort [call site] 00057