Fuzz introspector: flb-it-fuzz-pack_json_state_fuzzer_OSSFUZZ
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
61 65 3 :

['__errno_location', 'flb_errno_print', 'flb_realloc']

61 177 pack_string_token call site: 00037 /src/fluent-bit/src/flb_pack.c:125
0 2 1 :

['octal_digit']

2 4 u8_read_escape_sequence call site: 00044 /src/fluent-bit/src/flb_unescape.c:91
0 0 None 122 165 flb_unescape_string_utf8 call site: 00042 /src/fluent-bit/src/flb_unescape.c:176
0 0 None 122 122 flb_unescape_string_utf8 call site: 00053 /src/fluent-bit/src/flb_unescape.c:196
0 0 None 61 67 flb_pack_state_init call site: 00002 /src/fluent-bit/src/flb_pack.c:312
0 0 None 61 65 flb_json_tokenise call site: 00033 /src/fluent-bit/src/flb_pack.c:72
0 0 None 2 8 u8_read_escape_sequence call site: 00046 /src/fluent-bit/src/flb_unescape.c:98
0 0 None 2 8 u8_read_escape_sequence call site: 00048 /src/fluent-bit/src/flb_unescape.c:106
0 0 None 0 0 flb_malloc call site: 00003 /src/fluent-bit/include/fluent-bit/flb_mem.h:71
0 0 None 0 0 flb_malloc call site: 00003 /src/fluent-bit/include/fluent-bit/flb_mem.h:76
0 0 None 0 0 flb_fuzz_get_probability call site: 00003 /src/fluent-bit/include/fluent-bit/flb_mem.h:59
0 0 None 0 0 flb_pack_state_init call site: 00028 /src/fluent-bit/src/flb_pack.c:322

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 flb_pack_state_init [function] [call site] 00001
2 flb_malloc [function] [call site] 00002
3 flb_fuzz_get_probability [function] [call site] 00003
2 __errno_location [call site] 00004
2 flb_errno_print [function] [call site] 00005
3 __xpg_strerror_r [call site] 00006
3 flb_log_check [function] [call site] 00007
4 flb_worker_log_level [function] [call site] 00008
3 flb_log_print [function] [call site] 00009
4 flb_log_construct [function] [call site] 00010
5 isatty [call site] 00011
5 time [call site] 00012
5 localtime_r [call site] 00013
5 snprintf [call site] 00014
5 vsnprintf [call site] 00015
5 strlen [call site] 00016
4 flb_worker_get [function] [call site] 00017
4 flb_pipe_write_all [function] [call site] 00018
5 write [call site] 00019
5 __errno_location [call site] 00020
5 flb_time_msleep [function] [call site] 00021
6 nanosleep [call site] 00022
5 __errno_location [call site] 00023
5 flb_errno_print [function] [call site] 00024
4 fprintf [call site] 00025
4 perror [call site] 00026
4 fprintf [call site] 00027
2 flb_malloc [function] [call site] 00028
2 __errno_location [call site] 00029
2 flb_errno_print [function] [call site] 00030
2 flb_free [function] [call site] 00031
1 flb_pack_json_state [function] [call site] 00032
2 flb_json_tokenise [function] [call site] 00033
3 __errno_location [call site] 00034
3 flb_errno_print [function] [call site] 00035
2 tokens_to_msgpack [function] [call site] 00036
3 pack_string_token [function] [call site] 00037
4 flb_realloc [function] [call site] 00038
5 realloc [call site] 00039
4 __errno_location [call site] 00040
4 flb_errno_print [function] [call site] 00041
4 flb_unescape_string_utf8 [function] [call site] 00042
5 u8_read_escape_sequence [function] [call site] 00043
6 octal_digit [function] [call site] 00044
6 octal_digit [function] [call site] 00045
6 strtol [call site] 00046
6 hex_digit [function] [call site] 00047
6 strtol [call site] 00048
6 hex_digit [function] [call site] 00049
6 strtol [call site] 00050
6 hex_digit [function] [call site] 00051
6 strtol [call site] 00052
5 u8_wc_toutf8 [function] [call site] 00053
5 flb_log_check [function] [call site] 00054
5 flb_log_print [function] [call site] 00055
5 flb_log_check [function] [call site] 00056
5 flb_log_print [function] [call site] 00057
3 is_float [function] [call site] 00058
3 atof [call site] 00059
3 atoll [call site] 00060
1 flb_pack_state_reset [function] [call site] 00061
2 flb_free [function] [call site] 00062
2 flb_free [function] [call site] 00063
1 flb_free [function] [call site] 00064