Fuzz introspector: config_read_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
103 103 8 :

['__errno_location', 'libconfig_yyrealloc', 'getc', 'fread', 'ferror', 'yy_fatal_error', 'libconfig_yyrestart', 'clearerr']

103 103 yy_get_next_buffer call site: 00145 /src/libconfig/build/lib/scanner.c:1823
45 45 1 :

['libconfig_yyrestart']

45 660 __config_read call site: 00029 /src/libconfig/lib/libconfig.c:576
4 4 2 :

['fopen', 'fclose']

4 4 libconfig_scanctx_next_include_file call site: 00108 /src/libconfig/lib/scanctx.c:130
2 2 1 :

['abort']

2 2 open_null_file call site: 00002 /src/libconfig/fuzz/fuzz_config_read.c:33
2 2 1 :

['fputc']

2 2 __config_indent call site: 00357 /src/libconfig/lib/libconfig.c:147
2 2 2 :

['fclose', 'free']

2 2 libconfig_scanctx_pop_include call site: 00111 /src/libconfig/lib/scanctx.c:162
2 2 1 :

['__errno_location']

2 2 libconfig_yylex_init_extra call site: 00032 /src/libconfig/build/lib/scanner.c:2687
0 91 2 :

['__config_setting_create', 'config_setting_remove']

0 91 config_setting_add call site: 00171 /src/libconfig/lib/libconfig.c:1942
0 8 1 :

['config_setting_get_elem']

0 16 config_setting_set_string_elem call site: 00281 /src/libconfig/lib/libconfig.c:1808
0 8 1 :

['config_setting_get_elem']

0 14 config_setting_set_int64_elem call site: 00223 /src/libconfig/lib/libconfig.c:1658
0 8 1 :

['config_setting_get_elem']

0 13 config_setting_set_float_elem call site: 00270 /src/libconfig/lib/libconfig.c:1705
0 8 1 :

['config_setting_get_elem']

0 12 config_setting_set_int_elem call site: 00212 /src/libconfig/lib/libconfig.c:1610

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 open_null_file [function] [call site] 00001
2 fopen [call site] 00002
2 abort [call site] 00003
1 config_init [function] [call site] 00004
2 config_clear [function] [call site] 00005
3 __config_setting_destroy [function] [call site] 00006
4 config_setting_is_aggregate [function] [call site] 00007
4 __config_list_destroy [function] [call site] 00008
5 __config_setting_destroy [function] [call site] 00009
3 libconfig_strvec_delete [function] [call site] 00010
3 libconfig_calloc [function] [call site] 00011
4 calloc [call site] 00012
4 libconfig_fatal_error [function] [call site] 00013
1 fuzz_data_content [function] [call site] 00014
1 fuzz_data_path [function] [call site] 00015
1 config_read_string [function] [call site] 00016
2 __config_read [function] [call site] 00017
3 config_clear [function] [call site] 00018
3 __config_locale_override [function] [call site] 00019
4 newlocale [call site] 00020
4 uselocale [call site] 00021
3 libconfig_scanctx_init [function] [call site] 00022
4 strdup [call site] 00023
4 libconfig_strvec_append [function] [call site] 00024
5 libconfig_realloc [function] [call site] 00025
6 realloc [call site] 00026
6 libconfig_fatal_error [function] [call site] 00027
3 libconfig_scanctx_current_filename [function] [call site] 00028
3 libconfig_yylex_init_extra [function] [call site] 00029
4 libconfig_yyset_extra [function] [call site] 00030
4 __errno_location [call site] 00031
4 libconfig_yyalloc [function] [call site] 00032
5 libconfig_malloc [function] [call site] 00033
6 libconfig_fatal_error [function] [call site] 00034
4 __errno_location [call site] 00035
4 libconfig_yyset_extra [function] [call site] 00036
4 yy_init_globals [function] [call site] 00037
3 libconfig_yyrestart [function] [call site] 00038
4 libconfig_yyensure_buffer_stack [function] [call site] 00039
5 libconfig_yyalloc [function] [call site] 00040
5 yy_fatal_error [function] [call site] 00041
6 fprintf [call site] 00042
6 exit [call site] 00043
5 libconfig_yyrealloc [function] [call site] 00044
6 libconfig_realloc [function] [call site] 00045
5 yy_fatal_error [function] [call site] 00046
4 libconfig_yy_create_buffer [function] [call site] 00047
5 libconfig_yyalloc [function] [call site] 00048
5 yy_fatal_error [function] [call site] 00049
5 libconfig_yyalloc [function] [call site] 00050
5 yy_fatal_error [function] [call site] 00051
5 libconfig_yy_init_buffer [function] [call site] 00052
6 __errno_location [call site] 00053
6 libconfig_yy_flush_buffer [function] [call site] 00054
7 libconfig_yy_load_buffer_state [function] [call site] 00055
6 __errno_location [call site] 00056
4 libconfig_yy_init_buffer [function] [call site] 00057
4 libconfig_yy_load_buffer_state [function] [call site] 00058
3 libconfig_yy_scan_string [function] [call site] 00059
4 strlen [call site] 00060
4 libconfig_yy_scan_bytes [function] [call site] 00061
5 libconfig_yyalloc [function] [call site] 00062
5 yy_fatal_error [function] [call site] 00063
5 libconfig_yy_scan_buffer [function] [call site] 00064
6 libconfig_yyalloc [function] [call site] 00065
6 yy_fatal_error [function] [call site] 00066
6 libconfig_yy_switch_to_buffer [function] [call site] 00067
7 libconfig_yyensure_buffer_stack [function] [call site] 00068
7 libconfig_yy_load_buffer_state [function] [call site] 00069
5 yy_fatal_error [function] [call site] 00070
3 libconfig_yyset_lineno [function] [call site] 00071
4 yy_fatal_error [function] [call site] 00072
3 libconfig_yyparse [function] [call site] 00073
4 libconfig_malloc [function] [call site] 00074
4 libconfig_yylex [function] [call site] 00075
5 libconfig_yyensure_buffer_stack [function] [call site] 00076
5 libconfig_yy_create_buffer [function] [call site] 00077
5 libconfig_yy_load_buffer_state [function] [call site] 00078
5 libconfig_strbuf_append_string [function] [call site] 00079
6 strlen [call site] 00080
6 libconfig_strbuf_ensure_capacity [function] [call site] 00081
7 libconfig_realloc [function] [call site] 00082
6 strcpy [call site] 00083
5 libconfig_strbuf_append_char [function] [call site] 00084
6 libconfig_strbuf_ensure_capacity [function] [call site] 00085
5 libconfig_strbuf_append_char [function] [call site] 00086
5 libconfig_strbuf_append_char [function] [call site] 00087
5 libconfig_strbuf_append_char [function] [call site] 00088
5 libconfig_strbuf_append_char [function] [call site] 00089
5 libconfig_strbuf_append_char [function] [call site] 00090
5 libconfig_strbuf_append_char [function] [call site] 00091
5 libconfig_strbuf_append_char [function] [call site] 00092
5 libconfig_strbuf_append_char [function] [call site] 00093
5 strtol [call site] 00094
5 libconfig_strbuf_append_char [function] [call site] 00095
5 libconfig_strbuf_append_char [function] [call site] 00096
5 libconfig_scanctx_take_string [function] [call site] 00097
6 libconfig_strbuf_release [function] [call site] 00098
6 strdup [call site] 00099
5 libconfig_strbuf_append_string [function] [call site] 00100
5 libconfig_strbuf_append_char [function] [call site] 00101
5 libconfig_strbuf_append_char [function] [call site] 00102
5 libconfig_scanctx_take_string [function] [call site] 00103
5 libconfig_scanctx_push_include [function] [call site] 00104
6 libconfig_strvec_delete [function] [call site] 00105
6 libconfig_strvec_delete [function] [call site] 00106
6 libconfig_strvec_append [function] [call site] 00107
6 libconfig_scanctx_next_include_file [function] [call site] 00108
7 fclose [call site] 00109
7 fopen [call site] 00110
6 libconfig_scanctx_pop_include [function] [call site] 00111
7 fclose [call site] 00112
5 libconfig_yy_create_buffer [function] [call site] 00113
5 libconfig_yy_switch_to_buffer [function] [call site] 00114
5 libconfig_scanctx_current_filename [function] [call site] 00115
5 libconfig_yyget_lineno [function] [call site] 00116
5 atof [call site] 00117
5 libconfig_parse_integer [function] [call site] 00118
6 __errno_location [call site] 00119
6 __errno_location [call site] 00120
6 strtoll [call site] 00121
6 __errno_location [call site] 00122
6 __errno_location [call site] 00123
6 __errno_location [call site] 00124
6 __errno_location [call site] 00125
5 libconfig_parse_integer [function] [call site] 00126
5 libconfig_parse_integer [function] [call site] 00127
5 libconfig_parse_integer [function] [call site] 00128
5 libconfig_parse_integer [function] [call site] 00129
5 libconfig_scanctx_next_include_file [function] [call site] 00130
5 libconfig_yy_delete_buffer [function] [call site] 00131
6 libconfig_yyfree [function] [call site] 00132
6 libconfig_yyfree [function] [call site] 00133
5 libconfig_yy_create_buffer [function] [call site] 00134
5 libconfig_yy_switch_to_buffer [function] [call site] 00135
5 libconfig_scanctx_current_filename [function] [call site] 00136
5 libconfig_yyget_lineno [function] [call site] 00137
5 libconfig_scanctx_pop_include [function] [call site] 00138
5 libconfig_yy_delete_buffer [function] [call site] 00139
5 libconfig_yy_switch_to_buffer [function] [call site] 00140
5 fwrite [call site] 00141
5 yy_get_previous_state [function] [call site] 00142
5 yy_try_NUL_trans [function] [call site] 00143
5 yy_get_next_buffer [function] [call site] 00144
6 yy_fatal_error [function] [call site] 00145
6 libconfig_yyrealloc [function] [call site] 00146
6 yy_fatal_error [function] [call site] 00147
6 getc [call site] 00148
6 ferror [call site] 00149
6 yy_fatal_error [function] [call site] 00150
6 __errno_location [call site] 00151
6 fread [call site] 00152
6 clearerr [call site] 00153
6 libconfig_yyrestart [function] [call site] 00154
6 libconfig_yyrealloc [function] [call site] 00155
6 yy_fatal_error [function] [call site] 00156
5 yy_get_previous_state [function] [call site] 00157
5 yy_get_previous_state [function] [call site] 00158
5 yy_fatal_error [function] [call site] 00159
4 config_setting_add [function] [call site] 00160
5 __config_type_is_scalar [function] [call site] 00161
5 __config_validate_name [function] [call site] 00162
6 __ctype_b_loc [call site] 00163
6 __ctype_b_loc [call site] 00164
6 strchr [call site] 00165
5 config_setting_get_member [function] [call site] 00166
6 strlen [call site] 00167
6 __config_list_search [function] [call site] 00168
7 strlen [call site] 00169
7 strncmp [call site] 00170
5 config_get_option [function] [call site] 00171
5 config_setting_remove [function] [call site] 00172
6 config_setting_lookup [function] [call site] 00173
7 config_setting_lookup_const [function] [call site] 00174
8 strchr [call site] 00175
8 strtol [call site] 00176
8 config_setting_get_elem [function] [call site] 00177
9 config_setting_is_aggregate [function] [call site] 00178
8 strchr [call site] 00179
8 __config_list_search [function] [call site] 00180
6 strchr [call site] 00181
6 strlen [call site] 00182
6 __config_list_search [function] [call site] 00183
6 __config_list_remove [function] [call site] 00184
6 __config_setting_destroy [function] [call site] 00185
5 __config_setting_create [function] [call site] 00186
6 config_setting_is_aggregate [function] [call site] 00187
6 libconfig_calloc [function] [call site] 00188
6 strdup [call site] 00189
6 libconfig_calloc [function] [call site] 00190
6 __config_list_add [function] [call site] 00191
7 libconfig_realloc [function] [call site] 00192
4 libconfig_yyerror [function] [call site] 00193
5 libconfig_yyget_lineno [function] [call site] 00194
4 capture_parse_pos [function] [call site] 00195
5 libconfig_yyget_lineno [function] [call site] 00196
5 libconfig_scanctx_current_filename [function] [call site] 00197
4 config_setting_add [function] [call site] 00198
4 capture_parse_pos [function] [call site] 00199
4 config_setting_add [function] [call site] 00200
4 capture_parse_pos [function] [call site] 00201
4 libconfig_strbuf_append_string [function] [call site] 00202
4 libconfig_strbuf_append_string [function] [call site] 00203
4 config_setting_set_bool_elem [function] [call site] 00204
5 __config_list_checktype [function] [call site] 00205
5 __config_setting_create [function] [call site] 00206
5 config_setting_get_elem [function] [call site] 00207
5 config_setting_set_bool [function] [call site] 00208
4 libconfig_yyerror [function] [call site] 00209
4 capture_parse_pos [function] [call site] 00210
4 config_setting_set_bool [function] [call site] 00211
4 config_setting_set_int_elem [function] [call site] 00212
5 __config_list_checktype [function] [call site] 00213
5 __config_setting_create [function] [call site] 00214
5 config_setting_get_elem [function] [call site] 00215
5 config_setting_set_int [function] [call site] 00216
6 config_get_option [function] [call site] 00217
4 libconfig_yyerror [function] [call site] 00218
4 config_setting_set_format [function] [call site] 00219
4 capture_parse_pos [function] [call site] 00220
4 config_setting_set_int [function] [call site] 00221
4 config_setting_set_format [function] [call site] 00222
4 config_setting_set_int64_elem [function] [call site] 00223
5 __config_list_checktype [function] [call site] 00224
5 __config_setting_create [function] [call site] 00225
5 config_setting_get_elem [function] [call site] 00226
5 config_setting_set_int64 [function] [call site] 00227
6 config_get_option [function] [call site] 00228
4 libconfig_yyerror [function] [call site] 00229
4 config_setting_set_format [function] [call site] 00230
4 capture_parse_pos [function] [call site] 00231
4 config_setting_set_int64 [function] [call site] 00232
4 config_setting_set_format [function] [call site] 00233
4 config_setting_set_int_elem [function] [call site] 00234
4 libconfig_yyerror [function] [call site] 00235
4 config_setting_set_format [function] [call site] 00236
4 capture_parse_pos [function] [call site] 00237
4 config_setting_set_int [function] [call site] 00238
4 config_setting_set_format [function] [call site] 00239
4 config_setting_set_int64_elem [function] [call site] 00240
4 libconfig_yyerror [function] [call site] 00241
4 config_setting_set_format [function] [call site] 00242
4 capture_parse_pos [function] [call site] 00243
4 config_setting_set_int64 [function] [call site] 00244
4 config_setting_set_format [function] [call site] 00245
4 config_setting_set_int_elem [function] [call site] 00246
4 libconfig_yyerror [function] [call site] 00247
4 config_setting_set_format [function] [call site] 00248
4 capture_parse_pos [function] [call site] 00249
4 config_setting_set_int [function] [call site] 00250
4 config_setting_set_format [function] [call site] 00251
4 config_setting_set_int64_elem [function] [call site] 00252
4 libconfig_yyerror [function] [call site] 00253
4 config_setting_set_format [function] [call site] 00254
4 capture_parse_pos [function] [call site] 00255
4 config_setting_set_int64 [function] [call site] 00256
4 config_setting_set_format [function] [call site] 00257
4 config_setting_set_int_elem [function] [call site] 00258
4 libconfig_yyerror [function] [call site] 00259
4 config_setting_set_format [function] [call site] 00260
4 capture_parse_pos [function] [call site] 00261
4 config_setting_set_int [function] [call site] 00262
4 config_setting_set_format [function] [call site] 00263
4 config_setting_set_int64_elem [function] [call site] 00264
4 libconfig_yyerror [function] [call site] 00265
4 config_setting_set_format [function] [call site] 00266
4 capture_parse_pos [function] [call site] 00267
4 config_setting_set_int64 [function] [call site] 00268
4 config_setting_set_format [function] [call site] 00269
4 config_setting_set_float_elem [function] [call site] 00270
5 __config_list_checktype [function] [call site] 00271
5 __config_setting_create [function] [call site] 00272
5 config_setting_get_elem [function] [call site] 00273
5 config_setting_set_float [function] [call site] 00274
6 config_get_option [function] [call site] 00275
6 config_get_option [function] [call site] 00276
4 libconfig_yyerror [function] [call site] 00277
4 capture_parse_pos [function] [call site] 00278
4 config_setting_set_float [function] [call site] 00279
4 libconfig_strbuf_release [function] [call site] 00280
4 config_setting_set_string_elem [function] [call site] 00281
5 __config_list_checktype [function] [call site] 00282
5 __config_setting_create [function] [call site] 00283
5 config_setting_get_elem [function] [call site] 00284
5 config_setting_set_string [function] [call site] 00285
6 strdup [call site] 00286
4 libconfig_yyerror [function] [call site] 00287
4 capture_parse_pos [function] [call site] 00288
4 libconfig_strbuf_release [function] [call site] 00289
4 config_setting_set_string [function] [call site] 00290
4 config_setting_add [function] [call site] 00291
4 capture_parse_pos [function] [call site] 00292
4 libconfig_yyerror [function] [call site] 00293
4 yydestruct [function] [call site] 00294
4 yydestruct [function] [call site] 00295
4 libconfig_yyerror [function] [call site] 00296
4 yydestruct [function] [call site] 00297
4 yydestruct [function] [call site] 00298
3 libconfig_scanctx_current_filename [function] [call site] 00299
3 libconfig_scanctx_pop_include [function] [call site] 00300
3 libconfig_yy_delete_buffer [function] [call site] 00301
3 libconfig_yylex_destroy [function] [call site] 00302
4 libconfig_yy_delete_buffer [function] [call site] 00303
4 libconfig_yypop_buffer_state [function] [call site] 00304
5 libconfig_yy_delete_buffer [function] [call site] 00305
5 libconfig_yy_load_buffer_state [function] [call site] 00306
4 libconfig_yyfree [function] [call site] 00307
4 libconfig_yyfree [function] [call site] 00308
4 yy_init_globals [function] [call site] 00309
4 libconfig_yyfree [function] [call site] 00310
3 libconfig_scanctx_cleanup [function] [call site] 00311
4 fclose [call site] 00312
4 libconfig_strbuf_release [function] [call site] 00313
4 libconfig_strvec_release [function] [call site] 00314
3 libconfig_strbuf_release [function] [call site] 00315
3 __config_locale_restore [function] [call site] 00316
4 uselocale [call site] 00317
4 freelocale [call site] 00318
1 find_setting_recursive [function] [call site] 00319
2 strlen [call site] 00320
2 strncmp [call site] 00321
2 config_setting_length [function] [call site] 00322
3 config_setting_is_aggregate [function] [call site] 00323
2 config_setting_get_elem [function] [call site] 00324
2 find_setting_recursive [function] [call site] 00325
1 config_setting_length [function] [call site] 00326
1 config_setting_get_elem [function] [call site] 00327
1 config_setting_lookup_float [function] [call site] 00328
2 config_setting_get_member [function] [call site] 00329
2 __config_setting_get_float [function] [call site] 00330
3 config_get_option [function] [call site] 00331
3 config_get_option [function] [call site] 00332
1 config_setting_lookup_bool [function] [call site] 00333
2 config_setting_get_member [function] [call site] 00334
2 config_setting_get_bool [function] [call site] 00335
1 config_setting_lookup_int [function] [call site] 00336
2 config_setting_get_member [function] [call site] 00337
2 __config_setting_get_int [function] [call site] 00338
3 config_get_option [function] [call site] 00339
1 config_setting_lookup_int64 [function] [call site] 00340
2 config_setting_get_member [function] [call site] 00341
2 __config_setting_get_int64 [function] [call site] 00342
3 config_get_option [function] [call site] 00343
1 config_setting_lookup_string [function] [call site] 00344
2 config_setting_get_member [function] [call site] 00345
2 config_setting_get_string [function] [call site] 00346
1 config_setting_lookup_const [function] [call site] 00347
1 config_setting_get_member [function] [call site] 00348
1 config_setting_set_float [function] [call site] 00349
1 config_setting_add [function] [call site] 00350
1 config_setting_set_float [function] [call site] 00351
1 config_write [function] [call site] 00352
2 __config_locale_override [function] [call site] 00353
2 __config_write_setting [function] [call site] 00354
3 config_get_option [function] [call site] 00355
3 config_get_option [function] [call site] 00356
3 __config_indent [function] [call site] 00357
4 fprintf [call site] 00358
4 fputc [call site] 00359
3 fputs [call site] 00360
3 fprintf [call site] 00361
3 config_setting_get_format [function] [call site] 00362
3 __config_write_value [function] [call site] 00363
4 fputs [call site] 00364
4 fprintf [call site] 00365
4 libconfig_format_bin [function] [call site] 00366
4 fprintf [call site] 00367
4 fprintf [call site] 00368
4 fprintf [call site] 00369
4 fprintf [call site] 00370
4 libconfig_format_bin [function] [call site] 00371
4 fprintf [call site] 00372
4 fprintf [call site] 00373
4 fprintf [call site] 00374
4 config_get_option [function] [call site] 00375
4 libconfig_format_double [function] [call site] 00376
5 snprintf [call site] 00377
5 strchr [call site] 00378
5 strchr [call site] 00379
5 strcat [call site] 00380
5 strlen [call site] 00381
4 fputs [call site] 00382
4 fputc [call site] 00383
4 fputc [call site] 00384
4 fputc [call site] 00385
4 fputs [call site] 00386
4 fputs [call site] 00387
4 fputs [call site] 00388
4 fputs [call site] 00389
4 fputc [call site] 00390
4 fprintf [call site] 00391
4 fputc [call site] 00392
4 fputs [call site] 00393
4 config_setting_get_format [function] [call site] 00394
4 __config_write_value [function] [call site] 00395
5 fputc [call site] 00396
5 fputc [call site] 00397
5 fputc [call site] 00398
5 fputs [call site] 00399
5 config_setting_get_format [function] [call site] 00400
5 __config_write_value [function] [call site] 00401
6 fputc [call site] 00402
6 fputc [call site] 00403
6 fputc [call site] 00404
6 config_get_option [function] [call site] 00405
6 fputc [call site] 00406
6 __config_indent [function] [call site] 00407
6 fputs [call site] 00408
6 __config_write_setting [function] [call site] 00409
7 config_get_option [function] [call site] 00410
7 fputc [call site] 00411
7 fputc [call site] 00412
6 __config_indent [function] [call site] 00413
6 fputc [call site] 00414
6 fputs [call site] 00415
2 __config_locale_restore [function] [call site] 00416
1 config_setting_remove [function] [call site] 00417
1 config_destroy [function] [call site] 00418
2 __config_setting_destroy [function] [call site] 00419
2 libconfig_strvec_delete [function] [call site] 00420