Fuzz introspector: xml_parsebuffer_fuzzer_US-ASCII
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
493 493 1 :

['entityValueInitProcessor']

493 493 externalParEntInitProcessor call site: 00000 /src/expat/expat/lib/xmlparse.c:4647
272 286 2 :

['accountingReportDiff', 'accountingReportStats']

272 286 accountingDiffTolerated call site: 00000 /src/expat/expat/lib/xmlparse.c:8223
162 2845 15 :

['poolStoreString', 'processEntity', 'doCdataSection', 'reportProcessingInstruction', 'lookup', 'getContext', 'reportDefault', 'freeBindings', 'reportComment', 'XmlUtf8Encode', 'accountingDiffTolerated', 'poolClear', 'memcmp', 'storeAtts', 'accountingOnAbort']

162 3561 doContent call site: 00000 /src/expat/expat/lib/xmlparse.c:3213
162 2845 15 :

['poolStoreString', 'processEntity', 'doCdataSection', 'reportProcessingInstruction', 'lookup', 'getContext', 'reportDefault', 'freeBindings', 'reportComment', 'XmlUtf8Encode', 'accountingDiffTolerated', 'poolClear', 'memcmp', 'storeAtts', 'accountingOnAbort']

162 3561 doContent call site: 00000 /src/expat/expat/lib/xmlparse.c:3276
50 50 1 :

['generate_hash_secret_salt']

50 315 startParsing call site: 00072 /src/expat/expat/lib/xmlparse.c:1092
8 8 2 :

['__errno_location', 'strtoul']

8 8 getDebugLevel call site: 00021 /src/expat/expat/lib/xmlparse.c:8842
6 6 1 :

['reportDefault']

6 6 epilogProcessor call site: 00000 /src/expat/expat/lib/xmlparse.c:5924
6 6 1 :

['reportDefault']

6 6 doIgnoreSection call site: 00000 /src/expat/expat/lib/xmlparse.c:4427
6 6 1 :

['reportDefault']

6 6 reportProcessingInstruction call site: 00000 /src/expat/expat/lib/xmlparse.c:6709
6 6 1 :

['reportDefault']

6 6 reportComment call site: 00000 /src/expat/expat/lib/xmlparse.c:6734
2 2 1 :

['XmlSizeOfUnknownEncoding']

2 2 handleUnknownEncoding call site: 00000 /src/expat/expat/lib/xmlparse.c:4592
0 1313 1 :

['doProlog']

0 1315 internalEntityProcessor call site: 00000 /src/expat/expat/lib/xmlparse.c:6068

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 XML_ParserCreate [function] [call site] 00001
2 XML_ParserCreate_MM [function] [call site] 00002
3 parserCreate [function] [call site] 00003
4 dtdCreate [function] [call site] 00004
5 hashTableInit [function] [call site] 00007
5 hashTableInit [function] [call site] 00008
5 hashTableInit [function] [call site] 00009
5 hashTableInit [function] [call site] 00010
5 hashTableInit [function] [call site] 00011
4 parserInit [function] [call site] 00014
5 XmlPrologStateInit [function] [call site] 00015
5 copyString [function] [call site] 00016
5 XmlInitEncoding [function] [call site] 00017
6 getEncodingIndex [function] [call site] 00018
5 getDebugLevel [function] [call site] 00020
6 getenv [call site] 00021
6 __errno_location [call site] 00022
6 strtoul [call site] 00023
6 __errno_location [call site] 00024
6 __errno_location [call site] 00025
5 getDebugLevel [function] [call site] 00026
4 XML_ParserFree [function] [call site] 00027
5 destroyBindings [function] [call site] 00028
5 destroyBindings [function] [call site] 00029
5 destroyBindings [function] [call site] 00030
5 poolDestroy [function] [call site] 00031
5 poolDestroy [function] [call site] 00032
5 dtdDestroy [function] [call site] 00033
6 hashTableIterInit [function] [call site] 00034
6 hashTableIterNext [function] [call site] 00035
6 hashTableDestroy [function] [call site] 00036
6 hashTableDestroy [function] [call site] 00037
6 hashTableDestroy [function] [call site] 00038
6 hashTableDestroy [function] [call site] 00039
6 hashTableDestroy [function] [call site] 00040
6 poolDestroy [function] [call site] 00041
6 poolDestroy [function] [call site] 00042
4 XmlGetUtf8InternalEncodingNS [function] [call site] 00043
4 XmlGetUtf8InternalEncoding [function] [call site] 00044
1 __assert_fail [call site] 00045
1 ParseOneInput [function] [call site] 00046
2 sip_tokey [function] [call site] 00047
2 siphash24 [function] [call site] 00048
3 sip24_init [function] [call site] 00049
3 sip24_update [function] [call site] 00050
4 sip_round [function] [call site] 00051
3 sip24_final [function] [call site] 00052
2 XML_SetHashSalt [function] [call site] 00055
3 getRootParserOf [function] [call site] 00056
4 __assert_fail [call site] 00057
3 __assert_fail [call site] 00058
3 parserBusy [function] [call site] 00059
2 XML_SetUserData [function] [call site] 00060
2 XML_SetElementHandler [function] [call site] 00061
2 XML_SetCharacterDataHandler [function] [call site] 00064
2 may_stop_character_handler [function] [call site] 00065
3 XML_StopParser [function] [call site] 00066
4 __assert_fail [call site] 00067
2 __assert_fail [call site] 00068
2 XML_GetBuffer [function] [call site] 00069
2 __assert_fail [call site] 00070
2 XML_ParseBuffer [function] [call site] 00071
3 startParsing [function] [call site] 00072
4 generate_hash_secret_salt [function] [call site] 00073
5 writeRandomBytes_getrandom_nonblock [function] [call site] 00074
6 __assert_fail [call site] 00075
6 getrandom [call site] 00076
6 __errno_location [call site] 00077
5 ENTROPY_DEBUG [function] [call site] 00078
6 getDebugLevel [function] [call site] 00079
6 fprintf [call site] 00080
5 writeRandomBytes_dev_urandom [function] [call site] 00081
6 open [call site] 00082
6 read [call site] 00083
6 __errno_location [call site] 00084
6 close [call site] 00085
5 ENTROPY_DEBUG [function] [call site] 00086
5 gather_time_entropy [function] [call site] 00087
6 gettimeofday [call site] 00088
6 __assert_fail [call site] 00089
5 getpid [call site] 00090
5 ENTROPY_DEBUG [function] [call site] 00091
4 setContext [function] [call site] 00092
5 poolGrow [function] [call site] 00093
6 poolBytesToAllocateFor [function] [call site] 00094
6 poolBytesToAllocateFor [function] [call site] 00095
5 lookup [function] [call site] 00096
6 hash [function] [call site] 00097
7 copy_salt_to_sipkey [function] [call site] 00098
8 get_hash_secret_salt [function] [call site] 00099
9 getRootParserOf [function] [call site] 00100
9 __assert_fail [call site] 00101
7 sip24_init [function] [call site] 00102
7 sip24_update [function] [call site] 00104
7 sip24_final [function] [call site] 00105
5 poolCopyString [function] [call site] 00111
5 addBinding [function] [call site] 00115
6 is_rfc3986_uri_char [function] [call site] 00116
3 callProcessor [function] [call site] 00118
2 XML_GetBuffer [function] [call site] 00119
2 XML_ParseBuffer [function] [call site] 00120
2 XML_GetErrorCode [function] [call site] 00121
2 XML_ErrorString [function] [call site] 00122
2 XML_GetCurrentLineNumber [function] [call site] 00123
2 XML_ParserReset [function] [call site] 00124
3 moveToFreeBindingList [function] [call site] 00125
3 moveToFreeBindingList [function] [call site] 00126
3 poolClear [function] [call site] 00127
3 poolClear [function] [call site] 00128
3 parserInit [function] [call site] 00129
3 dtdReset [function] [call site] 00130
4 hashTableIterInit [function] [call site] 00131
4 hashTableIterNext [function] [call site] 00132
4 hashTableClear [function] [call site] 00133
4 hashTableClear [function] [call site] 00134
4 hashTableClear [function] [call site] 00135
4 hashTableClear [function] [call site] 00136
4 hashTableClear [function] [call site] 00137
4 poolClear [function] [call site] 00138
4 poolClear [function] [call site] 00139
1 XML_ParserCreateNS [function] [call site] 00140
2 XML_ParserCreate_MM [function] [call site] 00141
1 __assert_fail [call site] 00142
1 ParseOneInput [function] [call site] 00143
1 XML_ParserFree [function] [call site] 00144
1 XML_ExternalEntityParserCreate [function] [call site] 00145
2 parserCreate [function] [call site] 00146
2 parserCreate [function] [call site] 00147
2 dtdCopy [function] [call site] 00148
3 hashTableIterInit [function] [call site] 00149
3 hashTableIterNext [function] [call site] 00150
3 poolCopyString [function] [call site] 00151
3 hashTableIterInit [function] [call site] 00153
3 hashTableIterNext [function] [call site] 00154
3 poolCopyString [function] [call site] 00156
3 hashTableIterInit [function] [call site] 00159
3 hashTableIterNext [function] [call site] 00160
3 poolCopyString [function] [call site] 00161
3 poolCopyString [function] [call site] 00166
3 copyEntityTable [function] [call site] 00167
4 hashTableIterInit [function] [call site] 00168
4 hashTableIterNext [function] [call site] 00169
4 poolCopyString [function] [call site] 00170
4 poolCopyString [function] [call site] 00172
4 poolCopyString [function] [call site] 00173
4 poolCopyString [function] [call site] 00174
4 poolCopyStringN [function] [call site] 00175
4 poolCopyString [function] [call site] 00178
3 copyEntityTable [function] [call site] 00179
2 setContext [function] [call site] 00180
2 XML_ParserFree [function] [call site] 00181
2 XmlPrologStateInitExternalEntity [function] [call site] 00182
1 __assert_fail [call site] 00183
1 ParseOneInput [function] [call site] 00184
1 XML_ParserFree [function] [call site] 00185
1 XML_ExternalEntityParserCreate [function] [call site] 00186
1 __assert_fail [call site] 00187
1 ParseOneInput [function] [call site] 00188
1 XML_ParserFree [function] [call site] 00189
1 XML_ParserFree [function] [call site] 00190