Fuzz introspector: av1_dec_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
83 83 1 :

['convolve_2d_sr_general_avx2']

83 83 av1_convolve_2d_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_2d_avx2.c:153
69 69 1 :

['av1_convolve_x_sr_general_avx2']

69 69 av1_convolve_x_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_avx2.c:916
61 61 1 :

['av1_convolve_y_sr_general_avx2']

61 61 av1_convolve_y_sr_avx2 call site: 00000 /src/aom/av1/common/x86/convolve_avx2.c:521
38 38 4 :

['aom_lpf_vertical_8_dual_sse2', 'aom_lpf_vertical_14_dual_sse2', 'aom_lpf_vertical_4_dual_sse2', 'aom_lpf_vertical_6_dual_sse2']

38 38 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1053
32 32 1 :

['av1_highbd_convolve_2d_sr_ssse3']

32 32 av1_highbd_convolve_2d_sr_avx2 call site: 00000 /src/aom/av1/common/x86/highbd_convolve_2d_avx2.c:36
23 23 3 :

['aom_lpf_vertical_6_quad_sse2', 'aom_lpf_vertical_4_quad_sse2', 'aom_lpf_vertical_8_quad_sse2']

23 23 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1025
20 34 5 :

['x_convolve_6tap_4x2_ssse3', 'xy_x_round_store_4x2_sse2', 'xy_x_round_store_2x2_sse2', 'prepare_half_coeffs_6tap_ssse3', 'x_convolve_6tap_2x2_ssse3']

20 34 convolve_2d_sr_hor_6tap_avx2 call site: 00000 /src/aom/third_party/SVT-AV1/convolve_2d_avx2.h:200
20 20 4 :

['aom_lpf_horizontal_4_dual_sse2', 'aom_lpf_horizontal_8_dual_sse2', 'aom_lpf_horizontal_14_dual_sse2', 'aom_lpf_horizontal_6_dual_sse2']

20 20 filter_horz call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1655
19 19 1 :

['aom_highbd_lpf_vertical_6_dual_sse2']

19 19 filter_vert call site: 00000 /src/aom/av1/common/av1_loopfilter.c:964
7 7 1 :

['aom_highbd_lpf_horizontal_6_dual_sse2']

7 7 filter_horz call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1566
5 5 1 :

['aom_lpf_horizontal_4_quad_sse2']

5 5 filter_horz call site: 00000 /src/aom/av1/common/av1_loopfilter.c:1627
4 59 2 :

['equal_dimensions', 'aom_yv12_copy_frame_c']

4 68 av1_set_reference_dec call site: 00000 /src/aom/av1/decoder/decoder.c:299

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 aom_codec_av1_dx [function] [call site] 00001
1 aom_codec_dec_init_ver [function] [call site] 00002
2 aom_codec_destroy [function] [call site] 00003
1 aom_codec_control_typechecked_AV1_SET_TILE_MODE(aom_codec_ctx*, int, unsigned int) [function] [call site] 00004
2 aom_codec_control [function] [call site] 00005
3 at_ctrl_map_end [function] [call site] 00006
1 aom_codec_control_typechecked_AV1D_EXT_TILE_DEBUG(aom_codec_ctx*, int, unsigned int) [function] [call site] 00007
2 aom_codec_control [function] [call site] 00008
1 aom_codec_control_typechecked_AV1D_SET_IS_ANNEXB(aom_codec_ctx*, int, unsigned int) [function] [call site] 00009
2 aom_codec_control [function] [call site] 00010
1 aom_codec_control_typechecked_AV1D_SET_OUTPUT_ALL_LAYERS(aom_codec_ctx*, int, int) [function] [call site] 00011
2 aom_codec_control [function] [call site] 00012
1 aom_codec_control_typechecked_AV1D_SET_OPERATING_POINT(aom_codec_ctx*, int, int) [function] [call site] 00013
2 aom_codec_control [function] [call site] 00014
1 mem_get_le32_as_int(void const*) [function] [call site] 00015
1 aom_codec_peek_stream_info [function] [call site] 00016
1 aom_codec_decode [function] [call site] 00017
1 aom_codec_get_frame [function] [call site] 00018
1 aom_codec_destroy [function] [call site] 00019