Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
hwloc_look_linuxfs /src/hwloc/hwloc/topology-linux.c 2 ['struct hwloc_backend*', 'struct hwloc_disc_status*'] 14 0 58 11 26 376 0 3355 3355
Java_com_hwloc_lstopo_MainActivity_startWithInput /src/hwloc/contrib/android/AndroidApp/lstopo/src/main/cpp/lib.c 7 ['JNIEnv*', 'jobject', 'jobject*', 'int', 'jstring', 'jstring', 'jobjectArray'] 9 0 38 3 10 340 0 2664 1690
hwloc_look_xml /src/hwloc/hwloc/topology-xml.c 2 ['struct hwloc_backend*', 'struct hwloc_disc_status*'] 13 0 155 50 87 205 0 1986 792
output_console /src/hwloc/utils/lstopo/lstopo-text.c 2 ['struct lstopo_output*', 'char*'] 10 0 92 19 33 167 0 1351 675
hwloc_x86_discover /src/hwloc/hwloc/topology-x86.c 2 ['struct hwloc_backend*', 'struct hwloc_disc_status*'] 13 0 47 12 23 193 0 1499 507
cache_draw /src/hwloc/utils/lstopo/lstopo-draw.c 5 ['struct lstopo_output*', 'hwloc_obj_t', 'unsigned', 'unsigned', 'unsigned'] 6 0 39 6 15 69 0 741 416
transform_distances /src/hwloc/utils/hwloc/hwloc-annotate.c 2 ['hwloc_topology_t', 'int'] 14 0 103 25 44 203 0 1566 370
hwloc_synthetic_component_instantiate /src/hwloc/hwloc/topology-synthetic.c 6 ['struct hwloc_topology*', 'struct hwloc_disc_component*', 'unsigned excluded_phases', 'void*', 'void*', 'void*'] 5 0 20 5 23 32 0 411 312
hwloc_calc_process_location_info_cb /src/hwloc/utils/hwloc/hwloc-info.c 3 ['struct hwloc_calc_location_context_s*', 'void*', 'hwloc_obj_t'] 10 0 148 41 64 118 0 918 301
run_json_server /src/hwloc/utils/hwloc/hwloc-ps.c 2 ['hwloc_topology_t', 'hwloc_const_bitmap_t'] 10 0 106 18 25 135 0 660 283

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
44.0%
611 / 1397
Cyclomatic complexity statically reachable by fuzzers
54.0%
8746 / 16146

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzz driver synthesis

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

topology-linux.c

Target file: /src/hwloc/hwloc/topology-linux.c
Target functions: hwloc_look_linuxfs
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target hwloc_look_linuxfs */
  structhwloc_backend* new_var0 = calloc(sizeof(structhwloc_backend), 1);
  structhwloc_disc_status* new_var1 = calloc(sizeof(structhwloc_disc_status), 1);
  hwloc_look_linuxfs(new_var0, new_var1);

  af_safe_gb_cleanup();
}

lib.c

Target file: /src/hwloc/contrib/android/AndroidApp/lstopo/src/main/cpp/lib.c
Target functions: Java_com_hwloc_lstopo_MainActivity_startWithInput
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target Java_com_hwloc_lstopo_MainActivity_startWithInput */
  UNKNOWN_TYPE unknown_2;
  UNKNOWN_TYPE unknown_3;
  UNKNOWN_TYPE unknown_4;
  int new_var5 = ada_safe_get_int();
  UNKNOWN_TYPE unknown_6;
  UNKNOWN_TYPE unknown_7;
  UNKNOWN_TYPE unknown_8;
  Java_com_hwloc_lstopo_MainActivity_startWithInput(unknown_2, unknown_3, unknown_4, new_var5, unknown_6, unknown_7, unknown_8);

  af_safe_gb_cleanup();
}

topology-xml.c

Target file: /src/hwloc/hwloc/topology-xml.c
Target functions: hwloc_look_xml
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target hwloc_look_xml */
  structhwloc_backend* new_var9 = calloc(sizeof(structhwloc_backend), 1);
  structhwloc_disc_status* new_var10 = calloc(sizeof(structhwloc_disc_status), 1);
  hwloc_look_xml(new_var9, new_var10);

  af_safe_gb_cleanup();
}

lstopo-text.c

Target file: /src/hwloc/utils/lstopo/lstopo-text.c
Target functions: output_console
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target output_console */
  structlstopo_output* new_var11 = calloc(sizeof(structlstopo_output), 1);
  char *new_var12 = ada_safe_get_char_p();
  output_console(new_var11, new_var12);

  af_safe_gb_cleanup();
}

topology-x86.c

Target file: /src/hwloc/hwloc/topology-x86.c
Target functions: hwloc_x86_discover
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target hwloc_x86_discover */
  structhwloc_backend* new_var13 = calloc(sizeof(structhwloc_backend), 1);
  structhwloc_disc_status* new_var14 = calloc(sizeof(structhwloc_disc_status), 1);
  hwloc_x86_discover(new_var13, new_var14);

  af_safe_gb_cleanup();
}

lstopo-draw.c

Target file: /src/hwloc/utils/lstopo/lstopo-draw.c
Target functions: cache_draw
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target cache_draw */
  structlstopo_output* new_var15 = calloc(sizeof(structlstopo_output), 1);
  UNKNOWN_TYPE unknown_16;
  UNKNOWN_TYPE unknown_17;
  UNKNOWN_TYPE unknown_18;
  UNKNOWN_TYPE unknown_19;
  cache_draw(new_var15, unknown_16, unknown_17, unknown_18, unknown_19);

  af_safe_gb_cleanup();
}

hwloc-annotate.c

Target file: /src/hwloc/utils/hwloc/hwloc-annotate.c
Target functions: transform_distances
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target transform_distances */
  UNKNOWN_TYPE unknown_20;
  int new_var21 = ada_safe_get_int();
  transform_distances(unknown_20, new_var21);

  af_safe_gb_cleanup();
}

topology-synthetic.c

Target file: /src/hwloc/hwloc/topology-synthetic.c
Target functions: hwloc_synthetic_component_instantiate
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target hwloc_synthetic_component_instantiate */
  structhwloc_topology* new_var22 = calloc(sizeof(structhwloc_topology), 1);
  structhwloc_disc_component* new_var23 = calloc(sizeof(structhwloc_disc_component), 1);
  UNKNOWN_TYPE unknown_24;
  UNKNOWN_TYPE unknown_25;
  UNKNOWN_TYPE unknown_26;
  UNKNOWN_TYPE unknown_27;
  hwloc_synthetic_component_instantiate(new_var22, new_var23, unknown_24, unknown_25, unknown_26, unknown_27);

  af_safe_gb_cleanup();
}

hwloc-info.c

Target file: /src/hwloc/utils/hwloc/hwloc-info.c
Target functions: hwloc_calc_process_location_info_cb
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target hwloc_calc_process_location_info_cb */
  structhwloc_calc_location_context_s* new_var28 = calloc(sizeof(structhwloc_calc_location_context_s), 1);
  UNKNOWN_TYPE unknown_29;
  UNKNOWN_TYPE unknown_30;
  hwloc_calc_process_location_info_cb(new_var28, unknown_29, unknown_30);

  af_safe_gb_cleanup();
}

hwloc-ps.c

Target file: /src/hwloc/utils/hwloc/hwloc-ps.c
Target functions: run_json_server
#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target run_json_server */
  UNKNOWN_TYPE unknown_31;
  UNKNOWN_TYPE unknown_32;
  run_json_server(unknown_31, unknown_32);

  af_safe_gb_cleanup();
}

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
/src/hwloc/tests/hwloc/hwloc_bitmap_string.c [] []
/src/hwloc/include/hwloc/nvml.h [] []
/src/hwloc/tests/hwloc/opencl.c [] []
/src/hwloc/hwloc/topology-nvml.c [] []
/src/hwloc/hwloc/pci-common.c [] []
/src/hwloc/utils/hwloc/hwloc-gather-cpuid.c [] []
/src/hwloc/hwloc/bind.c [] []
/src/hwloc/tests/hwloc/cudart.c [] []
/src/hwloc/hwloc/topology-solaris.c [] []
/src/hwloc/utils/lstopo/lstopo-cairo.c [] []
/src/hwloc/include/hwloc/inlines.h [] []
/src/hwloc/include/hwloc/linux-libnuma.h [] []
/src/hwloc/hwloc/topology-synthetic.c [] []
/src/hwloc/tests/hwloc/hwloc_object_userdata.c [] []
/src/hwloc/include/hwloc/helper.h [] []
/src/hwloc/hwloc/topology-opencl.c [] []
/src/hwloc/hwloc/topology-xml.c [] []
/src/hwloc/tests/hwloc/shmem.c [] []
/src/hwloc/include/private/private.h [] []
/src/hwloc/utils/hwloc/hwloc-ps.c [] []
/src/hwloc/utils/lstopo/lstopo-xml.c [] []
/src/hwloc/hwloc/cpukinds.c [] []
/src/hwloc/hwloc/topology-rsmi.c [] []
/src/hwloc/hwloc/diff.c [] []
/src/hwloc/hwloc/topology-xml-nolibxml.c [] []
/src/hwloc/tests/hwloc/gl.c [] []
/src/hwloc/utils/hwloc/hwloc-dump-hwdata-knl.c [] []
/src/hwloc/tests/hwloc/nvml.c [] []
/src/hwloc/utils/hwloc/misc.h [] []
/src/hwloc/utils/hwloc/common-ps.c [] []
/src/hwloc/contrib/android/AndroidApp/lstopo/src/main/cpp/lib.c [] []
/src/hwloc/include/hwloc/opencl.h [] []
/src/hwloc/include/private/debug.h [] []
/src/hwloc/include/private/cpuid-x86.h [] []
/src/hwloc/tests/hwloc/hwloc_bitmap_compare_inclusion.c [] []
/src/hwloc/utils/hwloc/hwloc-annotate.c [] []
/src/hwloc/hwloc/topology-x86.c [] []
/src/hwloc/hwloc/topology-windows.c [] []
/src/hwloc/include/hwloc/cuda.h [] []
/src/hwloc/contrib/misc/hwloc-tweak-osindex.c [] []
/src/hwloc/utils/lstopo/lstopo-shmem.c [] []
/src/hwloc/hwloc/traversal.c [] []
/src/hwloc/hwloc/memattrs.c [] []
/src/hwloc/utils/hwloc/hwloc-info.c [] []
/src/hwloc/utils/lstopo/lstopo-ascii.c [] []
/src/hwloc/tests/hwloc/hwloc_bind.c [] []
/src/hwloc/tests/hwloc/hwloc_distances.c [] []
/src/hwloc/tests/hwloc/xmlbuffer.c [] []
/src/hwloc/include/hwloc/gl.h [] []
/src/hwloc/hwloc/topology-noos.c [] []
/src/hwloc/include/hwloc/distances.h [] []
/src/hwloc/hwloc/topology-hardwired.c [] []
/src/hwloc/utils/lstopo/lstopo-svg.c [] []
/src/hwloc/include/hwloc/cudart.h [] []
/src/hwloc/utils/lstopo/lstopo-windows.c [] []
/src/hwloc/hwloc/topology-xml-libxml.c [] []
/src/hwloc/include/hwloc/rsmi.h [] []
/src/hwloc/doc/examples/hwloc-hello.c [] []
/src/hwloc_fuzzer.c ['/src/hwloc_fuzzer.c'] []
/src/hwloc/utils/hwloc/hwloc-calc.c [] []
/src/hwloc/hwloc/topology-cuda.c [] []
/src/hwloc/utils/lstopo/lstopo.c [] []
/src/hwloc/tests/hwloc/hwloc_synthetic.c [] []
/src/hwloc/hwloc/bitmap.c [] []
/src/hwloc/hwloc/topology-hpux.c [] []
/src/hwloc/hwloc/topology-fake.c [] []
/src/hwloc/tests/hwloc/levelzero.c [] []
/src/hwloc/hwloc/topology-darwin.c [] []
/src/hwloc/utils/lstopo/lstopo-android.c [] []
/src/hwloc/utils/lstopo/lstopo-tikz.c [] []
/src/hwloc/hwloc/topology.c [] []
/src/hwloc/tests/hwloc/memtiers.c [] []
/src/hwloc/hwloc/topology-levelzero.c [] []
/src/hwloc/hwloc/topology-linux.c [] []
/src/hwloc/tests/hwloc/rsmi.c [] []
/src/hwloc/hwloc/topology-gl.c [] []
/src/hwloc/tests/hwloc/embedded/do_test.c [] []
/src/hwloc/hwloc/topology-netbsd.c [] []
/src/hwloc/tests/hwloc/hwloc_backends.c [] []
/src/hwloc/utils/lstopo/lstopo.h [] []
/src/hwloc/hwloc/base64.c ['/src/hwloc_fuzzer.c'] []
/src/hwloc/hwloc/topology-solaris-chiptype.c [] []
/src/hwloc/include/hwloc/levelzero.h [] []
/src/hwloc/include/private/misc.h [] []
/src/hwloc/tests/hwloc/hwloc_pci_backend.c [] []
/src/hwloc/hwloc/topology-pci.c [] []
/src/hwloc/contrib/coverity-model.c [] []
/src/hwloc/include/hwloc/plugins.h [] []
/src/hwloc/hwloc/topology-freebsd.c [] []
/src/hwloc/include/hwloc/openfabrics-verbs.h [] []
/src/hwloc/tests/hwloc/memattrs.c [] []
/src/hwloc/hwloc/components.c [] []
/src/hwloc/tests/hwloc/hwloc_type_sscanf.c [] []
/src/hwloc/hwloc/misc.c [] []
/src/hwloc/utils/hwloc/hwloc-calc.h [] []
/src/hwloc/hwloc/topology-aix.c [] []
/src/hwloc/tests/hwloc/hwloc_get_last_cpu_location.c [] []
/src/hwloc/utils/hwloc/hwloc-patch.c [] []
/src/hwloc/utils/lstopo/lstopo-fig.c [] []
/src/hwloc/utils/lstopo/lstopo-draw.c [] []
/src/hwloc/tests/hwloc/hwloc_is_thissystem.c [] []
/src/hwloc/utils/lstopo/lstopo-text.c [] []
/src/hwloc/include/hwloc/glibc-sched.h [] []
/src/hwloc/hwloc/distances.c [] []
/src/hwloc/hwloc/shmem.c [] []

Directories in report

Directory
/src/hwloc/contrib/
/src/hwloc/tests/hwloc/
/src/hwloc/utils/hwloc/
/src/hwloc/include/private/
/src/hwloc/doc/examples/
/src/hwloc/utils/lstopo/
/src/hwloc/contrib/misc/
/src/hwloc/include/hwloc/
/src/hwloc/tests/hwloc/embedded/
/src/hwloc/contrib/android/AndroidApp/lstopo/src/main/cpp/
/src/hwloc/hwloc/
/src/