Fuzz introspector: draco_mesh_decoder_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
8 10 5 :

['draco::Status::~Status()', 'draco::StatusOr > >::StatusOr(draco::Status const&)', '_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B7v180000ILi0EEEPKc', 'draco::Status::Status(draco::Status::Code, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator >::~basic_string()']

8 10 draco::CreateMeshDecoder(unsignedchar) call site: 00000 /src/draco/src/draco/compression/decode.cc:48
4 4 3 :

['atoi', 'std::__1::__map_const_iterator , std::__1::allocator >, std::__1::basic_string , std::__1::allocator > >, std::__1::__tree_node , std::__1::allocator >, std::__1::basic_string , std::__1::allocator > >, void*>*, long> >::operator->[abi:v180000]() const', 'std::__1::basic_string , std::__1::allocator >::c_str[abi:v180000]() const']

4 4 draco::Options::GetInt(std::__1::basic_string ,std::__1::allocator >const&,int)const call site: 00000 /src/draco/src/draco/core/options.cc:50
0 10 2 :

['draco::SequentialAttributeDecoder::attribute()', 'draco::AttributeOctahedronTransform::DecodeParameters(draco::PointAttribute const&, draco::DecoderBuffer*)']

0 1117 draco::SequentialNormalAttributeDecoder::DecodeIntegerValues(std::__1::vector ,std::__1::allocator >>const&,draco::DecoderBuffer*) call site: 00000 /src/draco/src/draco/compression/attributes/sequential_normal_attribute_decoder.cc:42
0 5 1 :

['bool draco::DecoderBuffer::Decode (unsigned long*)']

0 26 draco::RAnsSymbolDecoder<1>::StartDecoding(draco::DecoderBuffer*) call site: 00000 /src/draco/src/draco/compression/entropy/rans_symbol_decoder.h:139
0 5 1 :

['bool draco::DecoderBuffer::Decode (unsigned long*)']

0 26 draco::RAnsSymbolDecoder<9>::StartDecoding(draco::DecoderBuffer*) call site: 00000 /src/draco/src/draco/compression/entropy/rans_symbol_decoder.h:139
0 5 1 :

['bool draco::DecoderBuffer::Decode (unsigned long*)']

0 26 draco::RAnsSymbolDecoder<11>::StartDecoding(draco::DecoderBuffer*) call site: 00000 /src/draco/src/draco/compression/entropy/rans_symbol_decoder.h:139
0 5 1 :

['bool draco::DecoderBuffer::Decode (unsigned long*)']

0 26 draco::RAnsSymbolDecoder<13>::StartDecoding(draco::DecoderBuffer*) call site: 00000 /src/draco/src/draco/compression/entropy/rans_symbol_decoder.h:139
0 0 None 34 88 draco::SequentialAttributeDecodersController::TransformAttributesToOriginalFormat() call site: 00000 /src/draco/src/draco/compression/attributes/sequential_attribute_decoders_controller.cc:104
0 0 None 20 225 draco::Decoder::DecodeBufferToGeometry(draco::DecoderBuffer*,draco::Mesh*) call site: 00000 /src/draco/src/draco/compression/decode.cc:118
0 0 None 2 116 draco::PointCloudDecoder::Decode(draco::DracoOptions const&,draco::DecoderBuffer*,draco::PointCloud*) call site: 00000 /src/draco/src/draco/compression/point_cloud/point_cloud_decoder.cc:76
0 0 None 2 43 draco::PointCloudDecoder::DecodeHeader(draco::DecoderBuffer*,draco::DracoHeader*) call site: 00000 /src/draco/src/draco/compression/point_cloud/point_cloud_decoder.cc:31
0 0 None 0 109 draco::MeshTraversalSequencer >>::GenerateSequenceInternal() call site: 00000 /src/draco/src/draco/compression/mesh/traverser/mesh_traversal_sequencer.h:82

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 draco::DecoderBuffer::DecoderBuffer() [function] [call site] 00001
1 draco::DecoderBuffer::Init(char const*, unsigned long) [function] [call site] 00002
2 draco::DecoderBuffer::Init(char const*, unsigned long, unsigned short) [function] [call site] 00003
1 draco::Decoder::Decoder() [function] [call site] 00004
2 draco::DracoOptions<draco::GeometryAttribute::Type>::DracoOptions() [function] [call site] 00005
3 draco::Options::Options() [function] [call site] 00006
1 draco::Decoder::DecodeMeshFromBuffer(draco::DecoderBuffer*) [function] [call site] 00007
2 draco::Mesh::Mesh() [function] [call site] 00008
3 draco::PointCloud::PointCloud() [function] [call site] 00009
3 draco::IndexTypeVector<draco::IndexType<unsigned int, draco::FaceIndex_tag_type_>, std::__1::array<draco::IndexType<unsigned int, draco::PointIndex_tag_type_>, 3ul> >::IndexTypeVector() [function] [call site] 00010
2 draco::Decoder::DecodeBufferToGeometry(draco::DecoderBuffer*, draco::Mesh*) [function] [call site] 00011
3 draco::PointCloudDecoder::DecodeHeader(draco::DecoderBuffer*, draco::DracoHeader*) [function] [call site] 00012
4 draco::DecoderBuffer::Decode(void*, unsigned long) [function] [call site] 00013
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00014
4 memcmp [call site] 00015
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00016
4 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00017
5 bool draco::DecoderBuffer::Peek<unsigned char>(unsigned char*) [function] [call site] 00018
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00019
4 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00020
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00021
4 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00022
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00023
4 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00024
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00025
4 bool draco::DecoderBuffer::Decode<unsigned short>(unsigned short*) [function] [call site] 00026
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00027
4 draco::OkStatus() [function] [call site] 00028
5 draco::Status::Status(draco::Status::Code) [function] [call site] 00029
3 draco::Status::ok() const [function] [call site] 00030
3 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00031
3 draco::CreateMeshDecoder(unsigned char) [function] [call site] 00032
4 draco::MeshSequentialDecoder::MeshSequentialDecoder() [function] [call site] 00033
5 draco::MeshDecoder::MeshDecoder() [function] [call site] 00034
6 draco::PointCloudDecoder::PointCloudDecoder() [function] [call site] 00035
4 draco::StatusOr<std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> > >::StatusOr(std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> >&&) [function] [call site] 00036
5 draco::OkStatus() [function] [call site] 00037
4 draco::MeshEdgebreakerDecoder::MeshEdgebreakerDecoder() [function] [call site] 00038
5 draco::MeshDecoder::MeshDecoder() [function] [call site] 00039
4 draco::StatusOr<std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> > >::StatusOr(std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> >&&) [function] [call site] 00040
4 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00041
4 draco::StatusOr<std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> > >::StatusOr(draco::Status const&) [function] [call site] 00042
5 draco::Status::Status(draco::Status const&) [function] [call site] 00043
3 draco::StatusOr<std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> > >::ok() const [function] [call site] 00044
4 draco::Status::ok() const [function] [call site] 00045
3 draco::Status::Status(draco::Status const&) [function] [call site] 00046
3 draco::MeshDecoder::Decode(draco::DracoOptions<draco::GeometryAttribute::Type> const&, draco::DecoderBuffer*, draco::Mesh*) [function] [call site] 00047
4 draco::PointCloudDecoder::Decode(draco::DracoOptions<draco::GeometryAttribute::Type> const&, draco::DecoderBuffer*, draco::PointCloud*) [function] [call site] 00048
5 draco::PointCloudDecoder::DecodeHeader(draco::DecoderBuffer*, draco::DracoHeader*) [function] [call site] 00049
5 draco::Status::ok() const [function] [call site] 00050
5 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00051
5 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00052
5 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00053
5 draco::DecoderBuffer::set_bitstream_version(unsigned short) [function] [call site] 00054
5 draco::PointCloudDecoder::bitstream_version() const [function] [call site] 00055
5 draco::PointCloudDecoder::DecodeMetadata() [function] [call site] 00056
6 draco::GeometryMetadata::GeometryMetadata() [function] [call site] 00057
7 draco::Metadata::Metadata() [function] [call site] 00058
6 draco::MetadataDecoder::MetadataDecoder() [function] [call site] 00059
6 draco::MetadataDecoder::DecodeGeometryMetadata(draco::DecoderBuffer*, draco::GeometryMetadata*) [function] [call site] 00060
7 bool draco::DecodeVarint<unsigned int>(unsigned int*, draco::DecoderBuffer*) [function] [call site] 00061
8 bool draco::(anonymous namespace)::DecodeVarintUnsigned<unsigned int>(int, unsigned int*, draco::DecoderBuffer*) [function] [call site] 00062
9 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00063
9 bool draco::(anonymous namespace)::DecodeVarintUnsigned<unsigned int>(int, unsigned int*, draco::DecoderBuffer*) [function] [call site] 00064
7 bool draco::DecodeVarint<unsigned int>(unsigned int*, draco::DecoderBuffer*) [function] [call site] 00065
7 draco::AttributeMetadata::AttributeMetadata() [function] [call site] 00066
8 draco::Metadata::Metadata() [function] [call site] 00067
7 draco::AttributeMetadata::set_att_unique_id(unsigned int) [function] [call site] 00068
7 draco::MetadataDecoder::DecodeMetadata(draco::Metadata*) [function] [call site] 00069
8 draco::MetadataDecoder::DecodeName(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*) [function] [call site] 00070
9 bool draco::DecoderBuffer::Decode<unsigned char>(unsigned char*) [function] [call site] 00071
9 draco::DecoderBuffer::Decode(void*, unsigned long) [function] [call site] 00072
8 draco::Metadata::Metadata() [function] [call site] 00073
8 draco::Metadata::AddSubMetadata(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<draco::Metadata, std::__1::default_delete<draco::Metadata> >) [function] [call site] 00074
8 bool draco::DecodeVarint<unsigned int>(unsigned int*, draco::DecoderBuffer*) [function] [call site] 00075
8 draco::MetadataDecoder::DecodeEntry(draco::Metadata*) [function] [call site] 00076
9 draco::MetadataDecoder::DecodeName(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*) [function] [call site] 00077
9 bool draco::DecodeVarint<unsigned int>(unsigned int*, draco::DecoderBuffer*) [function] [call site] 00078
9 draco::DecoderBuffer::remaining_size() const [function] [call site] 00079
9 draco::DecoderBuffer::Decode(void*, unsigned long) [function] [call site] 00080
9 draco::Metadata::AddEntryBinary(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) [function] [call site] 00081
10 void draco::Metadata::AddEntry<std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > >(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) [function] [call site] 00082
11 draco::EntryValue::EntryValue<unsigned char>(std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) [function] [call site] 00083
8 bool draco::DecodeVarint<unsigned int>(unsigned int*, draco::DecoderBuffer*) [function] [call site] 00084
8 draco::DecoderBuffer::remaining_size() const [function] [call site] 00085
7 draco::GeometryMetadata::AddAttributeMetadata(std::__1::unique_ptr<draco::AttributeMetadata, std::__1::default_delete<draco::AttributeMetadata> >) [function] [call site] 00086
6 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00087
6 draco::PointCloud::AddMetadata(std::__1::unique_ptr<draco::GeometryMetadata, std::__1::default_delete<draco::GeometryMetadata> >) [function] [call site] 00088
6 draco::OkStatus() [function] [call site] 00089
5 draco::Status::ok() const [function] [call site] 00090
5 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00091
5 draco::Status::Status(draco::Status::Code, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00092
5 draco::OkStatus() [function] [call site] 00093
3 draco::Status::ok() const [function] [call site] 00094
3 draco::StatusOr<std::__1::unique_ptr<draco::MeshDecoder, std::__1::default_delete<draco::MeshDecoder> > >::~StatusOr() [function] [call site] 00095
4 draco::Status::~Status() [function] [call site] 00096
3 draco::DecoderBuffer::~DecoderBuffer() [function] [call site] 00097
2 draco::Status::ok() const [function] [call site] 00098
2 draco::StatusOr<std::__1::unique_ptr<draco::Mesh, std::__1::default_delete<draco::Mesh> > >::StatusOr(draco::Status const&) [function] [call site] 00099
2 draco::StatusOr<std::__1::unique_ptr<draco::Mesh, std::__1::default_delete<draco::Mesh> > >::StatusOr(std::__1::unique_ptr<draco::Mesh, std::__1::default_delete<draco::Mesh> >&&) [function] [call site] 00100
1 draco::StatusOr<std::__1::unique_ptr<draco::Mesh, std::__1::default_delete<draco::Mesh> > >::~StatusOr() [function] [call site] 00101
1 draco::Decoder::~Decoder() [function] [call site] 00102
1 draco::DecoderBuffer::~DecoderBuffer() [function] [call site] 00103