Fuzz introspector: firestore_serializer_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
5 48 2 :

['pb_release_single_field', 'iter_from_extension']

5 48 pb_release_single_field call site: 00031 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:1178
5 41 2 :

['pb_field_set_to_default', 'iter_from_extension']

5 41 pb_field_set_to_default call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:844
0 43 1 :

['pb_release_single_field']

0 97 decode_pointer_field call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:571
0 0 None 216 541 pb_decode_noinit call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:965
0 0 None 216 541 pb_decode_noinit call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:970
0 0 None 216 541 pb_decode_noinit call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:1015
0 0 None 71 313 decode_field call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:741
0 0 None 2 2 allocate_field call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:514
0 0 None 0 61 pb_release_union_field call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:1144
0 0 None 0 58 pb_release call site: 00029 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:1259
0 0 None 0 56 pb_release call site: 00030 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:1262
0 0 None 0 49 pb_message_set_to_defaults call site: 00000 /src/firebase-ios-sdk/build/external/src/nanopb/pb_decode.c:915

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 firebase::firestore::model::DatabaseId::DatabaseId(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >) [function] [call site] 00001
1 firebase::firestore::remote::Serializer::Serializer(firebase::firestore::model::DatabaseId) [function] [call site] 00002
2 firebase::firestore::model::DatabaseId::DatabaseId(firebase::firestore::model::DatabaseId&&) [function] [call site] 00003
1 firebase::firestore::model::DatabaseId::~DatabaseId() [function] [call site] 00004
1 firebase::firestore::nanopb::StringReader::StringReader(unsigned char const*, unsigned long) [function] [call site] 00005
2 firebase::firestore::nanopb::Reader::Reader() [function] [call site] 00006
3 firebase::firestore::util::ReadContext::ReadContext() [function] [call site] 00007
4 firebase::firestore::util::Status::OK() [function] [call site] 00008
5 firebase::firestore::util::Status::Status() [function] [call site] 00009
2 pb_istream_from_buffer [function] [call site] 00010
2 firebase::firestore::nanopb::Reader::~Reader() [function] [call site] 00011
3 firebase::firestore::util::ReadContext::~ReadContext() [function] [call site] 00012
4 firebase::firestore::util::Status::~Status() [function] [call site] 00013
1 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::TryParse(firebase::firestore::nanopb::Reader*) [function] [call site] 00014
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::Message() [function] [call site] 00015
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::fields() [function] [call site] 00016
3 pb_field_s const* firebase::firestore::nanopb::FieldsArray<firebase::firestore::_google_firestore_v1_Value>() [function] [call site] 00017
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::get() [function] [call site] 00018
2 firebase::firestore::nanopb::Reader::ok() const [function] [call site] 00019
3 firebase::firestore::util::ReadContext::ok() const [function] [call site] 00020
4 firebase::firestore::util::Status::ok() const [function] [call site] 00021
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::release() [function] [call site] 00022
3 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::get() [function] [call site] 00023
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::Message() [function] [call site] 00024
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::~Message() [function] [call site] 00025
3 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::Free() [function] [call site] 00026
4 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::fields() [function] [call site] 00027
4 firebase::firestore::nanopb::FreeNanopbMessage(pb_field_s const*, void*) [function] [call site] 00028
5 pb_release [function] [call site] 00029
6 pb_field_iter_begin [function] [call site] 00030
6 pb_release_single_field [function] [call site] 00031
7 iter_from_extension [function] [call site] 00032
8 pb_field_iter_begin [function] [call site] 00033
7 pb_release_single_field [function] [call site] 00034
8 pb_release [function] [call site] 00035
9 pb_field_iter_next [function] [call site] 00036
10 pb_field_iter_begin [function] [call site] 00037
3 __clang_call_terminate [call site] 00038
4 __cxa_begin_catch [call site] 00039
2 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::Message(firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>&&) [function] [call site] 00040
1 firebase::firestore::nanopb::Message<firebase::firestore::_google_firestore_v1_Value>::~Message() [function] [call site] 00041
1 firebase::firestore::nanopb::StringReader::~StringReader() [function] [call site] 00042
2 firebase::firestore::nanopb::Reader::~Reader() [function] [call site] 00043
1 __cxa_begin_catch [call site] 00044
1 __cxa_end_catch [call site] 00045
1 firebase::firestore::remote::Serializer::~Serializer() [function] [call site] 00046
2 firebase::firestore::model::DatabaseId::~DatabaseId() [function] [call site] 00047