Fuzz introspector: jq_fuzz_parse
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
70 239 5 :

['decSetOverflow', 'decCompare', 'decNumberZero', 'decShiftToMost', 'decApplyRound']

70 360 decFinalize call site: 00150 /src/jq/src/decNumber/decNumber.c:7289
25 195 8 :

['jv_invalid', 'jv_is_valid.199', 'parse_is_top_num', 'parser_reset', 'jv_free', 'seq_check_truncation', 'stream_seq_check_truncation', 'stream_is_top_num']

227 1215 scan call site: 00128 /src/jq/src/jv_parse.c:648
2 2 1 :

['decSetMaxValue']

2 2 decSetOverflow call site: 00155 /src/jq/src/decNumber/decNumber.c:7378
2 2 1 :

['abort']

2 2 jv_tsd_dec_ctx_init call site: 00247 /src/jq/src/jv.c:512
2 2 1 :

['abort']

2 2 tsd_dec_ctx_get call site: 00263 /src/jq/src/jv.c:542
0 372 3 :

['jv_array', 'jv_array_append', 'jv_copy']

0 621 jv_parser_next call site: 00464 /src/jq/src/jv_parse.c:848
0 372 3 :

['jv_array', 'jv_array_append', 'jv_copy']

0 372 make_error call site: 00440 /src/jq/src/jv_parse.c:760
0 245 2 :

['make_error', 'jv_free']

0 245 jv_parser_next call site: 00466 /src/jq/src/jv_parse.c:854
0 170 9 :

['jvp_object_ptr', 'jvp_object_buckets', 'jvp_refcnt_unshared', 'jvp_object_get_slot', 'jvp_object_free', 'jv_get_kind', 'jvp_object_size', 'jvp_object_new', 'jv_copy']

0 170 jvp_object_unshare call site: 00000 /src/jq/src/jv.c:1635
0 113 2 :

['jv_string', 'jv_invalid_with_msg']

0 245 jv_array_set call site: 00210 /src/jq/src/jv.c:995
0 41 1 :

['jv_array']

0 309 parser_reset call site: 00057 /src/jq/src/jv_parse.c:99
0 41 1 :

['jv_array']

0 47 parser_init call site: 00004 /src/jq/src/jv_parse.c:71

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 jv_parse [function] [call site] 00001
2 strlen [call site] 00002
2 jv_parse_sized [function] [call site] 00003
3 parser_init [function] [call site] 00004
4 jv_array [function] [call site] 00005
5 jv_array_sized [function] [call site] 00006
6 jvp_array_new [function] [call site] 00007
7 jvp_array_alloc [function] [call site] 00008
8 jv_mem_alloc [function] [call site] 00009
9 memory_exhausted [function] [call site] 00010
10 pthread_once [call site] 00011
10 tsd_init [function] [call site] 00012
11 pthread_key_create [call site] 00013
11 tsd_fini_thread [function] [call site] 00014
11 fprintf [call site] 00015
11 abort [call site] 00016
11 atexit [call site] 00017
11 tsd_fini [function] [call site] 00018
12 pthread_getspecific [call site] 00019
12 pthread_setspecific [call site] 00020
11 fprintf [call site] 00021
11 abort [call site] 00022
10 tsd_init_nomem_handler [function] [call site] 00023
11 pthread_getspecific [call site] 00024
11 calloc [call site] 00025
11 pthread_setspecific [call site] 00026
11 fprintf [call site] 00027
11 abort [call site] 00028
10 pthread_getspecific [call site] 00029
10 fprintf [call site] 00030
10 abort [call site] 00031
4 jv_invalid [function] [call site] 00032
4 jv_invalid [function] [call site] 00033
4 jv_invalid [function] [call site] 00034
4 jvp_dtoa_context_init [function] [call site] 00035
3 jv_parser_set_buf [function] [call site] 00036
4 __assert_fail [call site] 00037
3 jv_parser_next [function] [call site] 00038
4 jv_invalid [function] [call site] 00039
4 jv_invalid [function] [call site] 00040
4 jv_string [function] [call site] 00041
5 strlen [call site] 00042
5 jv_string_sized [function] [call site] 00043
6 jvp_utf8_is_valid [function] [call site] 00044
7 jvp_utf8_next [function] [call site] 00045
8 __assert_fail [call site] 00046
6 jvp_string_new [function] [call site] 00047
7 jvp_string_alloc [function] [call site] 00048
8 jv_mem_alloc [function] [call site] 00049
6 jvp_string_copy_replace_bad [function] [call site] 00050
7 jvp_string_alloc [function] [call site] 00051
7 jvp_utf8_next [function] [call site] 00052
7 jvp_utf8_encode [function] [call site] 00053
8 __assert_fail [call site] 00054
8 jvp_utf8_encode_length [function] [call site] 00055
7 __assert_fail [call site] 00056
4 parser_reset [function] [call site] 00057
5 jv_free [function] [call site] 00058
6 jvp_array_free [function] [call site] 00059
7 __assert_fail [call site] 00060
7 jvp_refcnt_dec [function] [call site] 00061
7 jvp_array_ptr [function] [call site] 00062
8 __assert_fail [call site] 00063
7 jv_free [function] [call site] 00064
8 jvp_string_free [function] [call site] 00065
9 jvp_string_ptr [function] [call site] 00066
10 __assert_fail [call site] 00067
9 jvp_refcnt_dec [function] [call site] 00068
9 jv_mem_free [function] [call site] 00069
8 jvp_object_free [function] [call site] 00070
9 __assert_fail [call site] 00071
9 jvp_refcnt_dec [function] [call site] 00072
9 jvp_object_size [function] [call site] 00073
10 __assert_fail [call site] 00074
9 jvp_object_get_slot [function] [call site] 00075
10 jvp_object_size [function] [call site] 00076
10 __assert_fail [call site] 00077
10 jvp_object_ptr [function] [call site] 00078
11 __assert_fail [call site] 00079
9 jv_get_kind [function] [call site] 00080
9 jvp_string_free [function] [call site] 00081
9 jv_free [function] [call site] 00082
10 jvp_invalid_free [function] [call site] 00083
11 __assert_fail [call site] 00084
11 jvp_refcnt_dec [function] [call site] 00085
11 jv_free [function] [call site] 00086
12 jvp_number_free [function] [call site] 00087
13 __assert_fail [call site] 00088
13 jvp_refcnt_dec [function] [call site] 00089
13 jvp_literal_number_ptr [function] [call site] 00090
14 __assert_fail [call site] 00091
13 jv_mem_free [function] [call site] 00092
13 jv_mem_free [function] [call site] 00093
11 jv_mem_free [function] [call site] 00094
9 jvp_object_ptr [function] [call site] 00095
9 jv_mem_free [function] [call site] 00096
7 jv_mem_free [function] [call site] 00097
5 jv_invalid [function] [call site] 00100
5 jv_invalid [function] [call site] 00102
4 jv_invalid [function] [call site] 00104
4 stream_check_done [function] [call site] 00105
5 jv_is_valid [function] [call site] 00106
6 jv_get_kind [function] [call site] 00107
5 jv_invalid [function] [call site] 00109
5 jv_is_valid [function] [call site] 00110
5 jv_copy [function] [call site] 00111
6 jvp_refcnt_inc [function] [call site] 00112
5 jv_array_slice [function] [call site] 00114
6 __assert_fail [call site] 00115
6 jvp_array_slice [function] [call site] 00116
7 __assert_fail [call site] 00117
7 jvp_array_length [function] [call site] 00118
8 __assert_fail [call site] 00119
7 jvp_clamp_slice_params [function] [call site] 00120
7 __assert_fail [call site] 00121
7 jv_array_sized [function] [call site] 00124
5 jv_invalid [function] [call site] 00127
4 scan [function] [call site] 00128
5 stream_seq_check_truncation [function] [call site] 00129
6 jv_get_kind [function] [call site] 00130
5 check_literal [function] [call site] 00131
6 jv_number_with_literal [function] [call site] 00141
7 jvp_literal_number_new [function] [call site] 00142
8 strlen [call site] 00143
8 decContextClearStatus [function] [call site] 00144
8 decNumberFromString [function] [call site] 00145
9 decNumberZero [function] [call site] 00146
9 decSetCoeff [function] [call site] 00149
9 decFinalize [function] [call site] 00150
10 decSetSubnormal [function] [call site] 00151
11 decSetCoeff [function] [call site] 00152
11 decApplyRound [function] [call site] 00153
12 decSetOverflow [function] [call site] 00154
13 decNumberZero [function] [call site] 00155
13 decSetMaxValue [function] [call site] 00156
12 decUnitAddSub [function] [call site] 00157
11 decShiftToMost [function] [call site] 00158
10 decNumberZero [function] [call site] 00159
10 decCompare [function] [call site] 00160
11 decUnitCompare [function] [call site] 00161
12 decUnitAddSub [function] [call site] 00162
10 decApplyRound [function] [call site] 00163
10 decSetSubnormal [function] [call site] 00164
10 decApplyRound [function] [call site] 00165
10 decSetOverflow [function] [call site] 00166
10 decShiftToMost [function] [call site] 00167
9 decFinalize [function] [call site] 00168
9 decStatus [function] [call site] 00169
10 decNumberZero [function] [call site] 00170
10 decContextSetStatus [function] [call site] 00171
11 raise [call site] 00172
8 jv_mem_free [function] [call site] 00173
6 jv_get_kind [function] [call site] 00174
5 check_literal [function] [call site] 00176
5 stream_check_done [function] [call site] 00177
5 jv_is_valid [function] [call site] 00178
5 __assert_fail [call site] 00179
5 parser_reset [function] [call site] 00180
5 jv_invalid [function] [call site] 00182
5 check_literal [function] [call site] 00184
5 stream_check_done [function] [call site] 00185
5 tokenadd [function] [call site] 00186
6 __assert_fail [call site] 00187
6 jv_mem_realloc [function] [call site] 00188
7 realloc [call site] 00189
7 memory_exhausted [function] [call site] 00190
6 __assert_fail [call site] 00191
5 stream_token [function] [call site] 00192
6 jv_is_valid [function] [call site] 00193
6 jv_get_kind [function] [call site] 00195
6 jv_number [function] [call site] 00197
6 jv_get_kind [function] [call site] 00199
6 jv_invalid [function] [call site] 00202
6 jv_is_valid [function] [call site] 00206
6 jv_get_kind [function] [call site] 00207
6 jv_array_set [function] [call site] 00208
7 __assert_fail [call site] 00209
7 jvp_array_length [function] [call site] 00210
7 jv_string [function] [call site] 00213
7 jvp_array_write [function] [call site] 00214
8 __assert_fail [call site] 00215
8 jvp_array_ptr [function] [call site] 00216
8 jvp_array_offset [function] [call site] 00217
9 __assert_fail [call site] 00218
8 jvp_refcnt_unshared [function] [call site] 00219
9 __assert_fail [call site] 00220
8 jvp_array_length [function] [call site] 00223
8 jvp_array_alloc [function] [call site] 00224
8 jvp_array_length [function] [call site] 00225
8 jvp_array_offset [function] [call site] 00226
8 jvp_array_free [function] [call site] 00227
6 jv_invalid [function] [call site] 00229
6 jv_get_kind [function] [call site] 00231
6 jv_number_value [function] [call site] 00232
7 __assert_fail [call site] 00233
7 jvp_literal_number_ptr [function] [call site] 00234
7 jvp_literal_number_to_double [function] [call site] 00235
8 __assert_fail [call site] 00236
8 jvp_dec_number_ptr [function] [call site] 00237
9 __assert_fail [call site] 00238
8 tsd_dec_ctx_get [function] [call site] 00239
9 pthread_once [call site] 00240
9 jv_tsd_dec_ctx_init [function] [call site] 00241
10 pthread_key_create [call site] 00242
10 jv_mem_free [function] [call site] 00243
10 fprintf [call site] 00244
10 abort [call site] 00245
10 pthread_key_create [call site] 00246
10 jv_mem_free [function] [call site] 00247
10 fprintf [call site] 00248
10 abort [call site] 00249
10 atexit [call site] 00250
10 jv_tsd_dec_ctx_fini [function] [call site] 00251
11 pthread_getspecific [call site] 00252
11 jv_mem_free [function] [call site] 00253
11 pthread_getspecific [call site] 00254
11 jv_mem_free [function] [call site] 00255
11 pthread_setspecific [call site] 00256
11 pthread_setspecific [call site] 00257
9 pthread_getspecific [call site] 00258
9 decContextDefault [function] [call site] 00259
10 decContextSetStatus [function] [call site] 00260
9 decContextDefault [function] [call site] 00261
9 __assert_fail [call site] 00262
9 pthread_setspecific [call site] 00263
9 fprintf [call site] 00264
9 abort [call site] 00265
8 decNumberReduce [function] [call site] 00266
9 decNaNs [function] [call site] 00267
10 decNumberCopy [function] [call site] 00268
10 decDecap [function] [call site] 00269
11 decGetDigits [function] [call site] 00270
9 decCopyFit [function] [call site] 00271
10 decSetCoeff [function] [call site] 00272
9 decFinalize [function] [call site] 00273
9 decTrim [function] [call site] 00274
10 decShiftToLeast [function] [call site] 00275
9 decStatus [function] [call site] 00276
8 decNumberToString [function] [call site] 00277
9 decToString [function] [call site] 00278
10 strcpy [call site] 00279
10 strcpy [call site] 00280
10 strcpy [call site] 00281
8 tsd_dtoa_context_get [function] [call site] 00282
9 pthread_once [call site] 00283
9 jv_tsd_dtoa_ctx_init [function] [call site] 00284
10 pthread_key_create [call site] 00285
10 tsd_dtoa_ctx_dtor [function] [call site] 00286
11 jvp_dtoa_context_free [function] [call site] 00287
12 jv_mem_free [function] [call site] 00290
11 jv_mem_free [function] [call site] 00291
10 fprintf [call site] 00292
10 abort [call site] 00293
10 atexit [call site] 00294
10 jv_tsd_dtoa_ctx_fini [function] [call site] 00295
11 pthread_getspecific [call site] 00296
11 tsd_dtoa_ctx_dtor [function] [call site] 00297
11 pthread_setspecific [call site] 00298
9 pthread_getspecific [call site] 00299
9 jvp_dtoa_context_init [function] [call site] 00300
9 pthread_setspecific [call site] 00301
9 fprintf [call site] 00302
9 abort [call site] 00303
8 jvp_strtod [function] [call site] 00304
6 jv_is_valid [function] [call site] 00392
6 jv_invalid [function] [call site] 00394
6 jv_number [function] [call site] 00395
6 jv_is_valid [function] [call site] 00396
6 jv_invalid [function] [call site] 00398
6 __assert_fail [call site] 00400
6 jv_is_valid [function] [call site] 00403
6 __assert_fail [call site] 00404
6 jv_get_kind [function] [call site] 00406
6 jv_is_valid [function] [call site] 00408
6 jv_invalid [function] [call site] 00410
6 jv_array_slice [function] [call site] 00412
6 jv_invalid [function] [call site] 00414
6 jv_is_valid [function] [call site] 00416
6 __assert_fail [call site] 00417
6 jv_get_kind [function] [call site] 00419
6 jv_is_valid [function] [call site] 00421
6 jv_invalid [function] [call site] 00423
6 jv_array_slice [function] [call site] 00425
6 jv_invalid [function] [call site] 00427
5 stream_check_done [function] [call site] 00429
5 found_string [function] [call site] 00430
5 stream_check_done [function] [call site] 00436
4 make_error [function] [call site] 00439
5 jv_string_vfmt [function] [call site] 00440
6 jv_mem_alloc [function] [call site] 00441
6 vsnprintf [call site] 00442
6 jv_string_sized [function] [call site] 00443
6 jv_mem_free [function] [call site] 00444
6 jv_mem_free [function] [call site] 00445
5 jv_invalid_with_msg [function] [call site] 00447
6 jv_mem_alloc [function] [call site] 00448
4 parser_reset [function] [call site] 00449
4 make_error [function] [call site] 00450
4 parser_reset [function] [call site] 00451
4 __assert_fail [call site] 00452
4 jv_invalid [function] [call site] 00453
4 __assert_fail [call site] 00454
4 make_error [function] [call site] 00456
4 make_error [function] [call site] 00457
4 parser_reset [function] [call site] 00458
4 check_literal [function] [call site] 00459
4 make_error [function] [call site] 00460
4 parser_reset [function] [call site] 00461
4 make_error [function] [call site] 00462
4 parser_reset [function] [call site] 00463
4 jv_is_valid [function] [call site] 00464
4 jv_invalid [function] [call site] 00466
4 make_error [function] [call site] 00467
3 jv_is_valid [function] [call site] 00468
3 jv_parser_next [function] [call site] 00469
3 jv_is_valid [function] [call site] 00470
3 jv_string [function] [call site] 00473
3 jv_string [function] [call site] 00478
3 parser_free [function] [call site] 00479
4 parser_reset [function] [call site] 00480
4 jv_mem_free [function] [call site] 00483
4 jv_mem_free [function] [call site] 00484
4 jvp_dtoa_context_free [function] [call site] 00485
3 jv_is_valid [function] [call site] 00486
3 jv_invalid_get_msg [function] [call site] 00488
4 __assert_fail [call site] 00489
3 jv_string_value [function] [call site] 00493
4 __assert_fail [call site] 00494
4 jvp_string_ptr [function] [call site] 00495
3 jv_string_fmt [function] [call site] 00496
4 jv_string_vfmt [function] [call site] 00497