Fuzz introspector: av1_dec_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
3733 9017 13 :

['get_last_nonzero_byte', 'read_padding', 'av1_init_read_bit_buffer', 'av1_set_single_tile_decoding_mode', 'read_sequence_header_obu', 'memcmp', 'byte_alignment', 'read_and_decode_one_tile_list', 'read_frame_header_obu', 'read_one_tile_group_obu', 'read_metadata', 'is_obu_in_current_operating_point', 'aom_read_obu_header_and_size']

3733 9017 aom_decode_frame_from_obus call site: 00000 /src/aom/av1/decoder/obu.c:1054
83 83 1 :

['av1_convolve_2d_sr_general_avx2']

83 83 av1_convolve_2d_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_2d_avx2.c:152
69 69 1 :

['av1_convolve_x_sr_general_avx2']

69 69 av1_convolve_x_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_avx2.c:908
61 61 1 :

['av1_convolve_y_sr_general_avx2']

61 61 av1_convolve_y_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_avx2.c:518
38 38 4 :

['aom_lpf_vertical_14_dual_sse2', 'aom_lpf_vertical_4_dual_sse2', 'aom_lpf_vertical_6_dual_sse2', 'aom_lpf_vertical_8_dual_sse2']

38 38 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1053
32 32 1 :

['av1_highbd_convolve_2d_sr_ssse3']

32 32 av1_highbd_convolve_2d_sr_avx2 call site: 00000 /src/aom/av1/common/x86/highbd_convolve_2d_avx2.c:36
28 28 1 :

['av1_highbd_convolve_x_sr_ssse3']

28 28 av1_highbd_convolve_x_sr_avx2 call site: 00000 /src/aom/aom_dsp/x86/highbd_convolve_avx2.c:191
26 26 1 :

['av1_highbd_convolve_y_sr_ssse3']

26 26 av1_highbd_convolve_y_sr_avx2 call site: 00000 /src/aom/aom_dsp/x86/highbd_convolve_avx2.c:45
23 23 3 :

['aom_lpf_vertical_8_quad_sse2', 'aom_lpf_vertical_6_quad_sse2', 'aom_lpf_vertical_4_quad_sse2']

23 23 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1025
20 34 5 :

['xy_x_round_store_2x2_sse2', 'x_convolve_6tap_4x2_ssse3', 'xy_x_round_store_4x2_sse2', 'x_convolve_6tap_2x2_ssse3', 'prepare_half_coeffs_6tap_ssse3']

20 34 convolve_2d_sr_hor_6tap_avx2 call site: 00000 /src/aom/third_party/SVT-AV1/convolve_2d_avx2.h:200
20 20 4 :

['aom_lpf_horizontal_8_dual_sse2', 'aom_lpf_horizontal_6_dual_sse2', 'aom_lpf_horizontal_14_dual_sse2', 'aom_lpf_horizontal_4_dual_sse2']

20 20 filter_horz call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1654
19 19 1 :

['aom_highbd_lpf_vertical_6_dual_sse2']

19 19 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:964

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 aom_codec_av1_dx [function] [call site] 00001
1 aom_codec_dec_init_ver [function] [call site] 00002
2 aom_codec_destroy [function] [call site] 00003
1 mem_get_le32_as_int(void const*) [function] [call site] 00004
1 aom_codec_decode [function] [call site] 00005
2 get_alg_priv [function] [call site] 00006
1 aom_codec_get_frame [function] [call site] 00007
2 get_alg_priv [function] [call site] 00008
1 aom_codec_destroy [function] [call site] 00009