Fuzz introspector: fuzz_mms_decode
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 17 1 :

['MmsValue_delete']

0 17 MmsValue_decodeMmsData call site: 00017 /src/libiec61850/src/mms/iso_mms/server/mms_access_result.c:216
0 2 1 :

['Memory_free']

0 2 Asn1PrimitiveValue_create call site: 00037 /src/libiec61850/src/mms/asn1/asn1_ber_primitive_value.c:39
0 2 1 :

['Memory_free']

0 2 MmsValue_newBitString call site: 00029 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:369
0 2 1 :

['Memory_free']

0 2 MmsValue_newInteger call site: 00039 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:1413
0 2 1 :

['Memory_free']

0 2 MmsValue_newUnsigned call site: 00045 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:1435
0 2 1 :

['Memory_free']

0 2 MmsValue_newOctetString call site: 00056 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:1472
0 2 1 :

['Memory_free']

0 2 MmsValue_createEmptyArray call site: 00012 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:2044
0 0 None 0 17 MmsValue_decodeMmsData call site: 00001 /src/libiec61850/src/mms/iso_mms/server/mms_access_result.c:162
0 0 None 0 17 MmsValue_decodeMmsData call site: 00016 /src/libiec61850/src/mms/iso_mms/server/mms_access_result.c:201
0 0 None 0 0 MmsValue_newDataAccessError call site: 00021 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:348
0 0 None 0 0 MmsValue_newBitString call site: 00026 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:362
0 0 None 0 0 MmsValue_delete call site: 00071 /src/libiec61850/src/mms/iso_mms/common/mms_value.c:1315

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 MmsValue_decodeMmsData [function] [call site] 00001
2 BerDecoder_decodeLength [function] [call site] 00002
3 BerDecoder_decodeLengthRecursive [function] [call site] 00003
4 getIndefiniteLength [function] [call site] 00004
5 BerDecoder_decodeLengthRecursive [function] [call site] 00005
2 getNumberOfElements [function] [call site] 00006
3 BerDecoder_decodeLength [function] [call site] 00007
2 MmsValue_createEmptyArray [function] [call site] 00008
3 Memory_calloc [function] [call site] 00009
4 calloc [call site] 00010
4 noMemoryAvailableHandler [function] [call site] 00011
3 Memory_calloc [function] [call site] 00012
3 Memory_free [function] [call site] 00013
2 MmsValue_createEmptyStructure [function] [call site] 00014
3 MmsValue_createEmptyArray [function] [call site] 00015
2 BerDecoder_decodeLength [function] [call site] 00016
2 MmsValue_decodeMmsData [function] [call site] 00017
3 MmsValue_setElement [function] [call site] 00018
3 BerDecoder_decodeUint32 [function] [call site] 00019
3 MmsValue_newDataAccessError [function] [call site] 00020
4 Memory_calloc [function] [call site] 00021
3 BerDecoder_decodeBoolean [function] [call site] 00022
3 MmsValue_newBoolean [function] [call site] 00023
4 Memory_calloc [function] [call site] 00024
3 MmsValue_newBitString [function] [call site] 00025
4 Memory_calloc [function] [call site] 00026
4 abs [call site] 00027
4 bitStringByteSize [function] [call site] 00028
4 Memory_calloc [function] [call site] 00029
4 Memory_free [function] [call site] 00030
3 MmsValue_newInteger [function] [call site] 00031
4 Memory_calloc [function] [call site] 00032
4 BerInteger_createInt32 [function] [call site] 00033
5 Asn1PrimitiveValue_create [function] [call site] 00034
6 Memory_malloc [function] [call site] 00035
7 noMemoryAvailableHandler [function] [call site] 00036
6 Memory_calloc [function] [call site] 00037
6 Memory_free [function] [call site] 00038
4 BerInteger_createInt64 [function] [call site] 00039
5 Asn1PrimitiveValue_create [function] [call site] 00040
4 Memory_free [function] [call site] 00041
3 MmsValue_newUnsigned [function] [call site] 00042
4 Memory_calloc [function] [call site] 00043
4 BerInteger_createInt32 [function] [call site] 00044
4 BerInteger_createInt64 [function] [call site] 00045
4 Memory_free [function] [call site] 00046
3 BerDecoder_decodeDouble [function] [call site] 00047
3 MmsValue_newDouble [function] [call site] 00048
4 Memory_calloc [function] [call site] 00049
3 BerDecoder_decodeFloat [function] [call site] 00050
3 MmsValue_newFloat [function] [call site] 00051
4 Memory_malloc [function] [call site] 00052
3 MmsValue_newOctetString [function] [call site] 00053
4 Memory_calloc [function] [call site] 00054
4 abs [call site] 00055
4 Memory_calloc [function] [call site] 00056
4 Memory_free [function] [call site] 00057
3 MmsValue_newVisibleStringFromByteArray [function] [call site] 00058
4 MmsValue_newStringFromByteArray [function] [call site] 00059
5 Memory_calloc [function] [call site] 00060
5 StringUtils_createStringFromBuffer [function] [call site] 00061
6 Memory_malloc [function] [call site] 00062
5 Memory_free [function] [call site] 00063
3 MmsValue_newBinaryTime [function] [call site] 00064
4 Memory_calloc [function] [call site] 00065
3 MmsValue_newBinaryTime [function] [call site] 00066
3 MmsValue_newVisibleStringFromByteArray [function] [call site] 00067
3 MmsValue_newUtcTime [function] [call site] 00068
4 Memory_calloc [function] [call site] 00069
3 MmsValue_setUtcTimeByBuffer [function] [call site] 00070
3 MmsValue_delete [function] [call site] 00071
4 Asn1PrimitiveValue_destroy [function] [call site] 00072
5 Memory_free [function] [call site] 00073
5 Memory_free [function] [call site] 00074
4 Memory_free [function] [call site] 00075
4 Memory_free [function] [call site] 00076
4 Memory_free [function] [call site] 00077
4 MmsValue_delete [function] [call site] 00078
5 Memory_free [function] [call site] 00079
5 Memory_free [function] [call site] 00080
1 MmsValue_delete [function] [call site] 00081