Fuzz introspector: xml_parsebuffer_fuzzer_UTF-16
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
272 286 2 :

['accountingReportStats', 'accountingReportDiff']

272 286 accountingDiffTolerated call site: 00026 /src/expat/expat/lib/xmlparse.c:7780
259 259 1 :

['setContext']

259 259 startParsing call site: 00493 /src/expat/expat/lib/xmlparse.c:958
162 4114 15 :

['doCdataSection', 'freeBindings', 'memcmp', 'lookup', 'processInternalEntity', 'getContext', 'poolClear', 'reportComment', 'reportDefault', 'poolStoreString', 'storeAtts', 'accountingDiffTolerated', 'XmlUtf8Encode', 'accountingOnAbort', 'reportProcessingInstruction']

162 4844 doContent call site: 00099 /src/expat/expat/lib/xmlparse.c:3012
162 4114 15 :

['doCdataSection', 'freeBindings', 'memcmp', 'lookup', 'processInternalEntity', 'getContext', 'poolClear', 'reportComment', 'reportDefault', 'poolStoreString', 'storeAtts', 'accountingDiffTolerated', 'XmlUtf8Encode', 'accountingOnAbort', 'reportProcessingInstruction']

162 4844 doContent call site: 00099 /src/expat/expat/lib/xmlparse.c:3073
50 50 1 :

['generate_hash_secret_salt']

309 309 startParsing call site: 00492 /src/expat/expat/lib/xmlparse.c:956
11 43 2 :

['poolStoreString', 'handleUnknownEncoding']

11 49 processXmlDecl call site: 00058 /src/expat/expat/lib/xmlparse.c:4333
11 11 1 :

['handleUnknownEncoding']

11 11 initializeEncoding call site: 00017 /src/expat/expat/lib/xmlparse.c:4272
8 8 2 :

['strtoul', '__errno_location']

8 8 getDebugLevel call site: 00457 /src/expat/expat/lib/xmlparse.c:8393
6 6 1 :

['reportDefault']

6 6 doContent call site: 00091 /src/expat/expat/lib/xmlparse.c:2784
6 6 1 :

['reportDefault']

6 6 epilogProcessor call site: 00245 /src/expat/expat/lib/xmlparse.c:5664
6 6 1 :

['reportDefault']

6 6 reportProcessingInstruction call site: 00250 /src/expat/expat/lib/xmlparse.c:6298
6 6 1 :

['reportDefault']

6 6 reportComment call site: 00256 /src/expat/expat/lib/xmlparse.c:6323

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 XML_ParserCreate [function] [call site] 00001
2 XML_ParserCreate_MM [function] [call site] 00002
3 parserCreate [function] [call site] 00003
4 realloc [call site] 00004
4 dtdCreate [function] [call site] 00005
5 hashTableInit [function] [call site] 00008
5 hashTableInit [function] [call site] 00009
5 hashTableInit [function] [call site] 00010
5 hashTableInit [function] [call site] 00011
5 hashTableInit [function] [call site] 00012
4 parserInit [function] [call site] 00015
5 prologInitProcessor [function] [call site] 00016
6 initializeEncoding [function] [call site] 00017
7 handleUnknownEncoding [function] [call site] 00018
8 XmlSizeOfUnknownEncoding [function] [call site] 00019
6 prologProcessor [function] [call site] 00020
7 doProlog [function] [call site] 00021
8 accountingDiffTolerated [function] [call site] 00022
9 getRootParserOf [function] [call site] 00023
10 __assert_fail [call site] 00024
9 __assert_fail [call site] 00025
9 accountingGetCurrentAmplification [function] [call site] 00026
10 __assert_fail [call site] 00027
9 accountingReportStats [function] [call site] 00028
10 getRootParserOf [function] [call site] 00029
10 __assert_fail [call site] 00030
10 accountingGetCurrentAmplification [function] [call site] 00031
10 fprintf [call site] 00032
9 accountingReportDiff [function] [call site] 00033
10 __assert_fail [call site] 00034
10 fprintf [call site] 00035
10 unsignedCharToPrintable [function] [call site] 00036
11 __assert_fail [call site] 00037
10 fprintf [call site] 00038
10 unsignedCharToPrintable [function] [call site] 00039
10 fprintf [call site] 00040
10 fprintf [call site] 00041
10 unsignedCharToPrintable [function] [call site] 00042
10 fprintf [call site] 00043
10 fprintf [call site] 00044
8 accountingOnAbort [function] [call site] 00045
9 accountingReportStats [function] [call site] 00046
8 processXmlDecl [function] [call site] 00047
9 accountingDiffTolerated [function] [call site] 00048
9 accountingOnAbort [function] [call site] 00049
9 poolStoreString [function] [call site] 00050
10 poolAppend [function] [call site] 00051
11 poolGrow [function] [call site] 00052
12 poolBytesToAllocateFor [function] [call site] 00053
12 poolBytesToAllocateFor [function] [call site] 00054
11 poolGrow [function] [call site] 00055
10 poolGrow [function] [call site] 00056
9 poolStoreString [function] [call site] 00057
9 reportDefault [function] [call site] 00058
9 poolStoreString [function] [call site] 00059
9 handleUnknownEncoding [function] [call site] 00060
9 poolClear [function] [call site] 00061
9 poolClear [function] [call site] 00062
8 poolStoreString [function] [call site] 00063
8 poolClear [function] [call site] 00064
8 processXmlDecl [function] [call site] 00065
8 lookup [function] [call site] 00066
9 hash [function] [call site] 00067
10 copy_salt_to_sipkey [function] [call site] 00068
11 get_hash_secret_salt [function] [call site] 00069
12 get_hash_secret_salt [function] [call site] 00070
10 sip24_init [function] [call site] 00071
10 sip24_update [function] [call site] 00073
11 sip_round [function] [call site] 00074
10 sip24_final [function] [call site] 00075
11 sip_round [function] [call site] 00076
11 sip_round [function] [call site] 00077
8 poolStoreString [function] [call site] 00081
8 normalizePublicId [function] [call site] 00082
8 poolStoreString [function] [call site] 00083
8 normalizePublicId [function] [call site] 00084
8 poolClear [function] [call site] 00085
8 contentProcessor [function] [call site] 00088
9 doContent [function] [call site] 00089
10 accountingDiffTolerated [function] [call site] 00090
10 accountingOnAbort [function] [call site] 00091
10 reportDefault [function] [call site] 00092
10 accountingDiffTolerated [function] [call site] 00093
10 reportDefault [function] [call site] 00094
10 poolStoreString [function] [call site] 00095
10 reportDefault [function] [call site] 00097
10 reportDefault [function] [call site] 00098
10 processInternalEntity [function] [call site] 00099
11 entityTrackingOnOpen [function] [call site] 00100
12 getRootParserOf [function] [call site] 00101
12 __assert_fail [call site] 00102
12 entityTrackingReportStats [function] [call site] 00103
13 __assert_fail [call site] 00104
13 fprintf [call site] 00105
11 doProlog [function] [call site] 00106
12 contentProcessor [function] [call site] 00107
13 storeRawNames [function] [call site] 00108
12 getElementType [function] [call site] 00109
13 poolStoreString [function] [call site] 00110
13 setElementTypePrefix [function] [call site] 00112
12 getAttributeId [function] [call site] 00116
12 poolAppendString [function] [call site] 00124
13 poolGrow [function] [call site] 00125
12 poolAppend [function] [call site] 00126
12 defineAttribute [function] [call site] 00127
12 poolGrow [function] [call site] 00128
12 poolGrow [function] [call site] 00129
12 poolClear [function] [call site] 00130
12 storeAttributeValue [function] [call site] 00131
13 appendAttributeValue [function] [call site] 00132
14 accountingDiffTolerated [function] [call site] 00133
14 accountingOnAbort [function] [call site] 00134
14 XmlUtf8Encode [function] [call site] 00135
14 poolGrow [function] [call site] 00136
14 poolAppend [function] [call site] 00137
14 poolGrow [function] [call site] 00138
14 accountingDiffTolerated [function] [call site] 00139
14 poolGrow [function] [call site] 00140
14 poolStoreString [function] [call site] 00141
14 entityTrackingOnOpen [function] [call site] 00143
14 appendAttributeValue [function] [call site] 00144
15 entityTrackingOnClose [function] [call site] 00145
16 getRootParserOf [function] [call site] 00146
16 __assert_fail [call site] 00147
16 entityTrackingReportStats [function] [call site] 00148
13 poolGrow [function] [call site] 00149
12 defineAttribute [function] [call site] 00150
12 poolGrow [function] [call site] 00151
12 poolGrow [function] [call site] 00152
12 poolClear [function] [call site] 00153
12 storeEntityValue [function] [call site] 00154
13 poolGrow [function] [call site] 00155
13 accountingDiffTolerated [function] [call site] 00156
13 accountingOnAbort [function] [call site] 00157
13 poolStoreString [function] [call site] 00158
13 entityTrackingOnOpen [function] [call site] 00160
13 entityTrackingOnClose [function] [call site] 00161
13 entityTrackingOnClose [function] [call site] 00162
13 entityTrackingOnOpen [function] [call site] 00163
13 storeEntityValue [function] [call site] 00164
14 entityTrackingOnClose [function] [call site] 00165
14 poolAppend [function] [call site] 00166
14 poolGrow [function] [call site] 00167
14 XmlUtf8Encode [function] [call site] 00168
14 poolGrow [function] [call site] 00169
12 poolStoreString [function] [call site] 00170
12 poolStoreString [function] [call site] 00172
12 poolStoreString [function] [call site] 00173
12 poolStoreString [function] [call site] 00174
12 poolStoreString [function] [call site] 00176
12 poolStoreString [function] [call site] 00178
12 poolStoreString [function] [call site] 00179
12 normalizePublicId [function] [call site] 00180
12 poolStoreString [function] [call site] 00181
12 poolClear [function] [call site] 00182
12 poolClear [function] [call site] 00183
12 reportDefault [function] [call site] 00184
12 doIgnoreSection [function] [call site] 00185
13 accountingDiffTolerated [function] [call site] 00186
13 accountingOnAbort [function] [call site] 00187
13 reportDefault [function] [call site] 00188
12 ignoreSectionProcessor [function] [call site] 00189
13 doIgnoreSection [function] [call site] 00190
13 prologProcessor [function] [call site] 00191
13 prologProcessor [function] [call site] 00192
12 nextScaffoldPart [function] [call site] 00193
12 __assert_fail [call site] 00194
12 poolStoreString [function] [call site] 00195
12 processInternalEntity [function] [call site] 00197
13 doContent [function] [call site] 00198
14 getContext [function] [call site] 00199
15 poolGrow [function] [call site] 00200
15 poolGrow [function] [call site] 00201
15 hashTableIterInit [function] [call site] 00202
15 hashTableIterNext [function] [call site] 00203
15 poolGrow [function] [call site] 00204
15 poolGrow [function] [call site] 00205
15 poolGrow [function] [call site] 00206
15 poolGrow [function] [call site] 00207
15 hashTableIterInit [function] [call site] 00208
15 hashTableIterNext [function] [call site] 00209
15 poolGrow [function] [call site] 00210
15 poolGrow [function] [call site] 00211
15 poolGrow [function] [call site] 00212
14 reportDefault [function] [call site] 00213
14 storeAtts [function] [call site] 00214
15 poolCopyString [function] [call site] 00216
16 poolGrow [function] [call site] 00217
15 setElementTypePrefix [function] [call site] 00219
15 getAttributeId [function] [call site] 00220
15 storeAttributeValue [function] [call site] 00221
15 poolStoreString [function] [call site] 00222
15 addBinding [function] [call site] 00223
16 is_rfc3986_uri_char [function] [call site] 00224
15 addBinding [function] [call site] 00225
15 copy_salt_to_sipkey [function] [call site] 00226
15 sip24_init [function] [call site] 00227
15 poolGrow [function] [call site] 00229
15 sip24_update [function] [call site] 00230
15 sip24_update [function] [call site] 00232
15 poolGrow [function] [call site] 00233
15 sip24_final [function] [call site] 00234
15 poolGrow [function] [call site] 00235
14 reportDefault [function] [call site] 00236
14 poolClear [function] [call site] 00237
14 poolStoreString [function] [call site] 00238
14 storeAtts [function] [call site] 00239
14 freeBindings [function] [call site] 00240
14 reportDefault [function] [call site] 00241
14 poolClear [function] [call site] 00242
14 freeBindings [function] [call site] 00243
14 epilogProcessor [function] [call site] 00244
15 epilogProcessor [function] [call site] 00245
16 accountingDiffTolerated [function] [call site] 00246
16 accountingOnAbort [function] [call site] 00247
16 reportDefault [function] [call site] 00248
16 reportDefault [function] [call site] 00249
16 reportProcessingInstruction [function] [call site] 00250
17 reportDefault [function] [call site] 00251
17 poolStoreString [function] [call site] 00252
17 poolStoreString [function] [call site] 00253
17 normalizeLines [function] [call site] 00254
17 poolClear [function] [call site] 00255
16 reportComment [function] [call site] 00256
17 reportDefault [function] [call site] 00257
17 poolStoreString [function] [call site] 00258
17 normalizeLines [function] [call site] 00259
17 poolClear [function] [call site] 00260
14 epilogProcessor [function] [call site] 00261
14 memcmp [call site] 00262
14 reportDefault [function] [call site] 00263
14 epilogProcessor [function] [call site] 00264
14 epilogProcessor [function] [call site] 00265
14 XmlUtf8Encode [function] [call site] 00266
14 reportDefault [function] [call site] 00267
14 reportDefault [function] [call site] 00268
14 reportDefault [function] [call site] 00269
14 doCdataSection [function] [call site] 00270
15 accountingDiffTolerated [function] [call site] 00271
15 accountingOnAbort [function] [call site] 00272
15 reportDefault [function] [call site] 00273
15 reportDefault [function] [call site] 00274
15 reportDefault [function] [call site] 00275
14 cdataSectionProcessor [function] [call site] 00276
15 doCdataSection [function] [call site] 00277
15 externalEntityContentProcessor [function] [call site] 00278
16 doContent [function] [call site] 00279
17 reportDefault [function] [call site] 00280
17 reportDefault [function] [call site] 00281
17 reportProcessingInstruction [function] [call site] 00282
17 reportComment [function] [call site] 00283
17 reportDefault [function] [call site] 00284
16 storeRawNames [function] [call site] 00285
15 externalEntityContentProcessor [function] [call site] 00286
15 contentProcessor [function] [call site] 00287
15 contentProcessor [function] [call site] 00288
13 internalEntityProcessor [function] [call site] 00289
14 doProlog [function] [call site] 00290
15 entityTrackingOnOpen [function] [call site] 00291
15 entityTrackingOnClose [function] [call site] 00292
15 entityTrackingOnClose [function] [call site] 00293
15 getElementType [function] [call site] 00294
15 nextScaffoldPart [function] [call site] 00295
15 getElementType [function] [call site] 00296
15 build_model [function] [call site] 00297
15 reportProcessingInstruction [function] [call site] 00298
15 reportComment [function] [call site] 00299
15 reportDefault [function] [call site] 00300
14 doContent [function] [call site] 00301
14 entityTrackingOnClose [function] [call site] 00302
14 prologProcessor [function] [call site] 00303
14 doProlog [function] [call site] 00304
14 contentProcessor [function] [call site] 00305
14 doContent [function] [call site] 00306
14 storeRawNames [function] [call site] 00307
13 entityTrackingOnClose [function] [call site] 00308
6 prologProcessor [function] [call site] 00309
5 XmlPrologStateInit [function] [call site] 00310
6 prolog0 [function] [call site] 00311
7 prolog1 [function] [call site] 00312
8 doctype0 [function] [call site] 00313
9 doctype1 [function] [call site] 00314
10 internalSubset [function] [call site] 00315
5 copyString [function] [call site] 00446
5 XmlInitEncoding [function] [call site] 00447
6 getEncodingIndex [function] [call site] 00448
6 initScanProlog [function] [call site] 00450
6 initScanContent [function] [call site] 00452
6 initUpdatePosition [function] [call site] 00454
7 normal_updatePosition [function] [call site] 00455
5 getDebugLevel [function] [call site] 00456
6 getenv [call site] 00457
6 __errno_location [call site] 00458
6 strtoul [call site] 00459
6 __errno_location [call site] 00460
6 __errno_location [call site] 00461
5 getDebugLevel [function] [call site] 00462
4 XML_ParserFree [function] [call site] 00463
5 destroyBindings [function] [call site] 00464
5 destroyBindings [function] [call site] 00465
5 destroyBindings [function] [call site] 00466
5 poolDestroy [function] [call site] 00467
5 poolDestroy [function] [call site] 00468
5 dtdDestroy [function] [call site] 00469
6 hashTableIterInit [function] [call site] 00470
6 hashTableIterNext [function] [call site] 00471
6 hashTableDestroy [function] [call site] 00472
6 hashTableDestroy [function] [call site] 00473
6 hashTableDestroy [function] [call site] 00474
6 hashTableDestroy [function] [call site] 00475
6 hashTableDestroy [function] [call site] 00476
6 poolDestroy [function] [call site] 00477
6 poolDestroy [function] [call site] 00478
4 XmlGetUtf8InternalEncodingNS [function] [call site] 00479
4 XmlGetUtf8InternalEncoding [function] [call site] 00480
1 __assert_fail [call site] 00481
1 XML_SetElementHandler [function] [call site] 00482
1 sip_tokey [function] [call site] 00484
1 siphash24 [function] [call site] 00485
2 sip24_init [function] [call site] 00486
1 XML_SetHashSalt [function] [call site] 00487
2 XML_SetHashSalt [function] [call site] 00488
1 XML_GetBuffer [function] [call site] 00489
1 __assert_fail [call site] 00490
1 XML_ParseBuffer [function] [call site] 00491
2 startParsing [function] [call site] 00492
3 generate_hash_secret_salt [function] [call site] 00493
4 writeRandomBytes_getrandom_nonblock [function] [call site] 00494
5 getrandom [call site] 00495
5 __errno_location [call site] 00496
4 ENTROPY_DEBUG [function] [call site] 00497
5 getDebugLevel [function] [call site] 00498
5 fprintf [call site] 00499
4 writeRandomBytes_dev_urandom [function] [call site] 00500
5 open [call site] 00501
5 read [call site] 00502
5 __errno_location [call site] 00503
5 close [call site] 00504
4 ENTROPY_DEBUG [function] [call site] 00505
4 gather_time_entropy [function] [call site] 00506
5 gettimeofday [call site] 00507
5 __assert_fail [call site] 00508
4 getpid [call site] 00509
4 ENTROPY_DEBUG [function] [call site] 00510
2 errorProcessor [function] [call site] 00521
1 XML_ParserFree [function] [call site] 00522