Fuzz introspector: libgd/tests/fuzzing/fuzz_png_decode.c
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
50 59 gdImageCreate call site: 00059 gdImageDestroy
13 21 _gd_error_ex call site: 00021 gdImageCreateTrueColor
8 10 gdFree call site: 00010 gdImageCreateFromPngCtx
4 48 gdCalloc call site: 00048 gdImageCreate
2 0 EP call site: 00000 gdNewDynamicCtxEx
2 7 newDynamic call site: 00007
2 38 gd_error_ex call site: 00038 gd_error_ex
2 111 gdImageDestroy call site: 00111
2 114 gdImageDestroy call site: 00114 gdImageDestroy
1 45 gdImageCreateTrueColor call site: 00045
1 57 gdImageCreate call site: 00057

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 gdImageCreateFromPngPtr [function] [call site] 00001
2 gdNewDynamicCtxEx [function] [call site] 00002
3 gdMalloc [function] [call site] 00003
4 malloc [function] [call site] 00004
3 newDynamic [function] [call site] 00005
4 gdMalloc [function] [call site] 00006
4 allocDynamic [function] [call site] 00007
5 gdMalloc [function] [call site] 00008
4 gdFree [function] [call site] 00009
5 free [function] [call site] 00010
3 gdFree [function] [call site] 00011
2 gdImageCreateFromPngCtx [function] [call site] 00012
3 memset [function] [call site] 00013
3 gdGetBuf [function] [call site] 00014
3 png_sig_cmp [function] [call site] 00015
3 png_create_read_struct [function] [call site] 00016
3 png_create_read_struct [function] [call site] 00017
3 gd_error [function] [call site] 00018
4 va_start [function] [call site] 00019
4 _gd_error_ex [function] [call site] 00020
5 gd_error_method [function] [call site] 00021
4 va_end [function] [call site] 00022
3 png_create_info_struct [function] [call site] 00023
3 gd_error [function] [call site] 00024
3 png_destroy_read_struct [function] [call site] 00025
3 setjmp [function] [call site] 00026
3 gd_error [function] [call site] 00027
3 png_destroy_read_struct [function] [call site] 00028
3 png_set_sig_bytes [function] [call site] 00029
3 png_set_read_fn [function] [call site] 00030
3 png_set_user_limits [function] [call site] 00031
3 png_read_info [function] [call site] 00032
3 png_get_IHDR [function] [call site] 00033
3 gdImageCreateTrueColor [function] [call site] 00034
4 overflow2 [function] [call site] 00035
5 gd_error_ex [function] [call site] 00036
6 va_start [function] [call site] 00037
6 _gd_error_ex [function] [call site] 00038
6 va_end [function] [call site] 00039
5 gd_error_ex [function] [call site] 00040
4 overflow2 [function] [call site] 00041
4 overflow2 [function] [call site] 00042
4 gdMalloc [function] [call site] 00043
4 memset [function] [call site] 00044
4 gdMalloc [function] [call site] 00045
4 gdFree [function] [call site] 00046
4 gdCalloc [function] [call site] 00047
5 calloc [function] [call site] 00048
4 gdFree [function] [call site] 00049
4 gdFree [function] [call site] 00050
4 gdFree [function] [call site] 00051
3 gdImageCreate [function] [call site] 00052
4 overflow2 [function] [call site] 00053
4 overflow2 [function] [call site] 00054
4 overflow2 [function] [call site] 00055
4 gdCalloc [function] [call site] 00056
4 gdMalloc [function] [call site] 00057
4 gdFree [function] [call site] 00058
4 gdCalloc [function] [call site] 00059
4 gdFree [function] [call site] 00060
4 gdFree [function] [call site] 00061
4 gdFree [function] [call site] 00062
3 gd_error [function] [call site] 00063
3 png_set_strip_16 [function] [call site] 00064
3 png_set_packing [function] [call site] 00065
3 setjmp [function] [call site] 00066
3 gd_error [function] [call site] 00067
3 png_get_valid [function] [call site] 00068
3 png_get_pHYs [function] [call site] 00069
3 DPM2DPI [function] [call site] 00070
3 DPM2DPI [function] [call site] 00071
3 png_get_PLTE [function] [call site] 00072
3 gd_error [function] [call site] 00073
3 png_get_valid [function] [call site] 00074
3 png_get_tRNS [function] [call site] 00075
3 gdMalloc [function] [call site] 00076
3 gd_error [function] [call site] 00077
3 png_get_valid [function] [call site] 00078
3 png_get_tRNS [function] [call site] 00079
3 png_set_gray_to_rgb [function] [call site] 00080
3 png_get_valid [function] [call site] 00081
3 png_get_tRNS [function] [call site] 00082
3 gdTrueColor [function] [call site] 00083
3 gdTrueColor [function] [call site] 00084
3 gd_error [function] [call site] 00085
3 png_set_interlace_handling [function] [call site] 00086
3 png_read_update_info [function] [call site] 00087
3 png_get_rowbytes [function] [call site] 00088
3 overflow2 [function] [call site] 00089
3 gdMalloc [function] [call site] 00090
3 gd_error [function] [call site] 00091
3 overflow2 [function] [call site] 00092
3 gdMalloc [function] [call site] 00093
3 gd_error [function] [call site] 00094
3 setjmp [function] [call site] 00095
3 gd_error [function] [call site] 00096
3 png_read_image [function] [call site] 00097
3 png_read_end [function] [call site] 00098
3 png_destroy_read_struct [function] [call site] 00099
3 gdTrueColor [function] [call site] 00100
3 gdTrueColorAlpha [function] [call site] 00101
3 fprintf [function] [call site] 00102
3 gdFree [function] [call site] 00103
3 gdFree [function] [call site] 00104
3 gdFree [function] [call site] 00105
3 png_destroy_read_struct [function] [call site] 00106
3 gdImageDestroy [function] [call site] 00107
4 gdFree [function] [call site] 00108
4 gdFree [function] [call site] 00109
4 gdFree [function] [call site] 00110
4 gdFree [function] [call site] 00111
4 gdFree [function] [call site] 00112
4 gdFree [function] [call site] 00113
4 gdFree [function] [call site] 00114
2 gdIOCtx*::gd_free [function] [call site] 00115
1 gdImageDestroy [function] [call site] 00116