Fuzz introspector: bmp_target
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 105 5 :

['gdImageSetPixel', 'gdSeek', 'gdTell', 'gdGetByte', 'gdGetWordLSB']

0 105 bmp_read_direct call site: 00163 /src/libgd/src/gd_bmp.c:774
0 105 5 :

['gdImageSetPixel', 'gdSeek', 'gdTell', 'gdGetByte', 'gdGetWordLSB']

0 105 bmp_read_direct call site: 00163 /src/libgd/src/gd_bmp.c:780
0 2 1 :

['gdMalloc']

0 2 allocDynamic call site: 00006 /src/libgd/src/gd_io_dp.c:327
0 0 None 12 22 dynamicSeek call site: 00026 /src/libgd/src/gd_io_dp.c:189
0 0 None 12 22 dynamicSeek call site: 00026 /src/libgd/src/gd_io_dp.c:196
0 0 None 0 632 gdImageCreateFromBmpCtx call site: 00035 /src/libgd/src/gd_bmp.c:514
0 0 None 0 603 gdImageCreateFromBmpCtx call site: 00045 /src/libgd/src/gd_bmp.c:528
0 0 None 0 150 bmp_read_4bit call site: 00145 /src/libgd/src/gd_bmp.c:994
0 0 None 0 14 gdImageCreate call site: 00093 /src/libgd/src/gd.c:198
0 0 None 0 14 gdImageCreateTrueColor call site: 00083 /src/libgd/src/gd.c:305
0 0 None 0 10 gdImageCreate call site: 00094 /src/libgd/src/gd.c:204
0 0 None 0 10 gdImageCreate call site: 00096 /src/libgd/src/gd.c:217

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 gdImageCreateFromBmpPtr [function] [call site] 00001
2 gdNewDynamicCtxEx [function] [call site] 00002
3 gdMalloc [function] [call site] 00003
3 newDynamic [function] [call site] 00004
4 gdMalloc [function] [call site] 00005
4 allocDynamic [function] [call site] 00006
5 gdMalloc [function] [call site] 00007
4 gdFree [function] [call site] 00008
3 gdFree [function] [call site] 00009
3 dynamicGetchar [function] [call site] 00010
4 dynamicGetbuf [function] [call site] 00011
3 dynamicPutchar [function] [call site] 00012
4 appendDynamic [function] [call site] 00013
5 overflow2 [function] [call site] 00014
6 gd_error_ex [function] [call site] 00015
7 _gd_error_ex [function] [call site] 00016
6 gd_error_ex [function] [call site] 00017
5 gdReallocDynamic [function] [call site] 00018
6 gdRealloc [function] [call site] 00019
7 realloc [call site] 00020
6 gdMalloc [function] [call site] 00021
6 gdFree [function] [call site] 00022
3 dynamicGetbuf [function] [call site] 00023
3 dynamicPutbuf [function] [call site] 00024
4 appendDynamic [function] [call site] 00025
3 dynamicSeek [function] [call site] 00026
4 overflow2 [function] [call site] 00027
4 gdReallocDynamic [function] [call site] 00028
3 dynamicTell [function] [call site] 00029
3 gdFreeDynamicCtx [function] [call site] 00030
4 gdFree [function] [call site] 00031
4 gdFree [function] [call site] 00032
4 gdFree [function] [call site] 00033
2 gdImageCreateFromBmpCtx [function] [call site] 00034
3 gdCalloc [function] [call site] 00035
4 calloc [call site] 00036
3 bmp_read_header [function] [call site] 00037
4 gdGetWordLSB [function] [call site] 00038
4 gdGetIntLSB [function] [call site] 00039
4 gdGetWordLSB [function] [call site] 00040
4 gdGetWordLSB [function] [call site] 00041
4 gdGetIntLSB [function] [call site] 00042
3 gdFree [function] [call site] 00043
3 gdFree [function] [call site] 00044
3 gdCalloc [function] [call site] 00045
3 gdFree [function] [call site] 00046
3 bmp_read_info [function] [call site] 00047
4 gdGetIntLSB [function] [call site] 00048
4 bmp_read_windows_v3_info [function] [call site] 00049
5 gdGetIntLSB [function] [call site] 00050
5 gdGetIntLSB [function] [call site] 00051
5 gdGetWordLSB [function] [call site] 00052
5 gdGetWordLSB [function] [call site] 00053
5 gdGetIntLSB [function] [call site] 00054
5 gdGetIntLSB [function] [call site] 00055
5 gdGetIntLSB [function] [call site] 00056
5 gdGetIntLSB [function] [call site] 00057
5 gdGetIntLSB [function] [call site] 00058
5 gdGetIntLSB [function] [call site] 00059
4 bmp_read_os2_v1_info [function] [call site] 00060
5 gdGetWordLSB [function] [call site] 00061
5 gdGetWordLSB [function] [call site] 00062
5 gdGetWordLSB [function] [call site] 00063
5 gdGetWordLSB [function] [call site] 00064
4 bmp_read_os2_v2_info [function] [call site] 00065
5 gdGetIntLSB [function] [call site] 00066
5 gdGetIntLSB [function] [call site] 00067
5 gdGetWordLSB [function] [call site] 00068
5 gdGetWordLSB [function] [call site] 00069
5 gdGetIntLSB [function] [call site] 00070
5 gdGetIntLSB [function] [call site] 00071
5 gdGetIntLSB [function] [call site] 00072
5 gdGetIntLSB [function] [call site] 00073
5 gdGetIntLSB [function] [call site] 00074
5 gdGetIntLSB [function] [call site] 00075
5 gdGetBuf [function] [call site] 00076
3 gdFree [function] [call site] 00077
3 gdFree [function] [call site] 00078
3 gdImageCreateTrueColor [function] [call site] 00079
4 overflow2 [function] [call site] 00080
4 overflow2 [function] [call site] 00081
4 overflow2 [function] [call site] 00082
4 gdMalloc [function] [call site] 00083
4 gdMalloc [function] [call site] 00084
4 gdFree [function] [call site] 00085
4 gdCalloc [function] [call site] 00086
4 gdFree [function] [call site] 00087
4 gdFree [function] [call site] 00088
3 gdImageCreate [function] [call site] 00089
4 overflow2 [function] [call site] 00090
4 overflow2 [function] [call site] 00091
4 overflow2 [function] [call site] 00092
4 gdCalloc [function] [call site] 00093
4 gdMalloc [function] [call site] 00094
4 gdFree [function] [call site] 00095
4 gdCalloc [function] [call site] 00096
4 gdFree [function] [call site] 00097
4 gdFree [function] [call site] 00098
4 gdFree [function] [call site] 00099
3 gdFree [function] [call site] 00100
3 gdFree [function] [call site] 00101
3 bmp_read_1bit [function] [call site] 00102
4 bmp_read_palette [function] [call site] 00103
5 gdGetByte [function] [call site] 00104
5 gdGetByte [function] [call site] 00105
5 gdGetByte [function] [call site] 00106
5 gdGetByte [function] [call site] 00107
4 gdTell [function] [call site] 00108
4 gdSeek [function] [call site] 00109
4 gdGetByte [function] [call site] 00110
4 gdImageSetPixel [function] [call site] 00111
5 gdImageSetPixel [function] [call site] 00112
6 gdImageSetPixel [function] [call site] 00113
7 gdImageBrushApply [function] [call site] 00114
8 gdImageGetTrueColorPixel [function] [call site] 00115
9 gdImageGetPixel [function] [call site] 00116
8 gdImageSetPixel [function] [call site] 00117
9 gdImageTileApply [function] [call site] 00118
10 gdImageGetPixel [function] [call site] 00119
10 gdImageSetPixel [function] [call site] 00120
11 gdImageSetPixel [function] [call site] 00121
12 gdAlphaBlend [function] [call site] 00122
12 gdLayerOverlay [function] [call site] 00123
13 gdAlphaOverlayColor [function] [call site] 00124
13 gdAlphaOverlayColor [function] [call site] 00125
13 gdAlphaOverlayColor [function] [call site] 00126
12 gdLayerMultiply [function] [call site] 00127
10 gdImageGetPixel [function] [call site] 00128
10 gdImageColorResolveAlpha [function] [call site] 00129
10 gdImageSetPixel [function] [call site] 00130
10 gdImageSetPixel [function] [call site] 00131
8 gdImageGetPixel [function] [call site] 00132
8 gdImageGetTrueColorPixel [function] [call site] 00133
8 gdImageSetPixel [function] [call site] 00134
8 gdImageGetPixel [function] [call site] 00135
8 gdImageColorResolveAlpha [function] [call site] 00136
8 gdImageSetPixel [function] [call site] 00137
8 gdImageSetPixel [function] [call site] 00138
4 gdGetByte [function] [call site] 00139
3 bmp_read_4bit [function] [call site] 00140
4 bmp_read_palette [function] [call site] 00141
4 gdTell [function] [call site] 00142
4 gdSeek [function] [call site] 00143
4 gdGetByte [function] [call site] 00144
4 gdImageSetPixel [function] [call site] 00145
4 gdImageSetPixel [function] [call site] 00146
4 gdGetByte [function] [call site] 00147
4 bmp_read_rle [function] [call site] 00148
5 gdGetByte [function] [call site] 00149
5 gdImageSetPixel [function] [call site] 00150
5 gdGetByte [function] [call site] 00151
5 gdImageSetPixel [function] [call site] 00152
5 gdGetByte [function] [call site] 00153
5 gdGetByte [function] [call site] 00154
3 bmp_read_8bit [function] [call site] 00155
4 bmp_read_palette [function] [call site] 00156
4 gdTell [function] [call site] 00157
4 gdSeek [function] [call site] 00158
4 gdGetByte [function] [call site] 00159
4 gdImageSetPixel [function] [call site] 00160
4 gdGetByte [function] [call site] 00161
4 bmp_read_rle [function] [call site] 00162
3 bmp_read_direct [function] [call site] 00163
4 gdTell [function] [call site] 00164
4 gdSeek [function] [call site] 00165
4 gdGetWordLSB [function] [call site] 00166
4 gdGetByte [function] [call site] 00167
4 gdGetByte [function] [call site] 00168
4 gdImageSetPixel [function] [call site] 00169
4 gdGetByte [function] [call site] 00170
3 gdFree [function] [call site] 00171
3 gdFree [function] [call site] 00172
3 gdImageDestroy [function] [call site] 00173
4 gdFree [function] [call site] 00174
4 gdFree [function] [call site] 00175
4 gdFree [function] [call site] 00176
4 gdFree [function] [call site] 00177
4 gdFree [function] [call site] 00178
4 gdFree [function] [call site] 00179
1 gdImageDestroy [function] [call site] 00180