Fuzz introspector: rans_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
35 35 6 :

['float const& std::__1::min (float const&, float const&)', 'jpegli::N_SSE4::DitherRow(jpeg_decompress_struct*, float*, int, unsigned long, unsigned long)', 'jpegli::N_SSE4::LimitError(float)', 'jpegli::LookupColorIndex(jpeg_decompress_struct*, unsigned char*)', 'round(float)', 'float const& std::__1::max (float const&, float const&)']

35 51 jpegli::N_SSE4::WriteToOutput(jpeg_decompress_struct*,float*restrict*,unsignedlong,unsignedlong,unsignedlong,unsignedchar*) call site: 00000 /src/libjxl/lib/jpegli/render.cc:203
35 35 6 :

['float const& std::__1::min (float const&, float const&)', 'jpegli::LookupColorIndex(jpeg_decompress_struct*, unsigned char*)', 'round(float)', 'float const& std::__1::max (float const&, float const&)', 'jpegli::N_SSE2::DitherRow(jpeg_decompress_struct*, float*, int, unsigned long, unsigned long)', 'jpegli::N_SSE2::LimitError(float)']

35 51 jpegli::N_SSE2::WriteToOutput(jpeg_decompress_struct*,float*restrict*,unsignedlong,unsignedlong,unsignedlong,unsignedchar*) call site: 00000 /src/libjxl/lib/jpegli/render.cc:203
35 35 6 :

['float const& std::__1::min (float const&, float const&)', 'jpegli::LookupColorIndex(jpeg_decompress_struct*, unsigned char*)', 'round(float)', 'jpegli::N_AVX2::DitherRow(jpeg_decompress_struct*, float*, int, unsigned long, unsigned long)', 'jpegli::N_AVX2::LimitError(float)', 'float const& std::__1::max (float const&, float const&)']

35 48 jpegli::N_AVX2::WriteToOutput(jpeg_decompress_struct*,float*restrict*,unsignedlong,unsignedlong,unsignedlong,unsignedchar*) call site: 00000 /src/libjxl/lib/jpegli/render.cc:203
0 4 1 :

['jpegli::FormatString(char*, char const*, ...)']

0 12 jpegli::(anonymousnamespace)::FreePool(jpeg_common_struct*,int) call site: 00000 /src/libjxl/lib/jpegli/memory_manager.cc:138
0 4 1 :

['jpegli::FormatString(char*, char const*, ...)']

0 9 jpegli::PrepareForScan(jpeg_decompress_struct*) call site: 00000 /src/libjxl/lib/jpegli/decode.cc:266
0 4 1 :

['jpegli::FormatString(char*, char const*, ...)']

0 4 jpegli_consume_input call site: 00000 /src/libjxl/lib/jpegli/decode.cc:612
0 0 None 783 1436 jpegli_start_decompress call site: 00000 /src/libjxl/lib/jpegli/decode.cc:759
0 0 None 6 504 jpegli::ConsumeInput(jpeg_decompress_struct*) call site: 00000 /src/libjxl/lib/jpegli/decode.cc:342
0 0 None 6 504 jpegli::ConsumeInput(jpeg_decompress_struct*) call site: 00000 /src/libjxl/lib/jpegli/decode.cc:366
0 0 None 5 7 hwy::(anonymousnamespace)::x86::DetectTargets() call site: 00000 /src/libjxl/third_party/highway/hwy/targets.cc:269
0 0 None 5 7 hwy::(anonymousnamespace)::x86::DetectTargets() call site: 00000 /src/libjxl/third_party/highway/hwy/targets.cc:272
0 0 None 0 628 jpegli_read_scanlines call site: 00000 /src/libjxl/lib/jpegli/decode.cc:852

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 jpegxl::tools::TestOneInput(unsigned char const*, unsigned long) [function] [call site] 00001
2 jxl::Status::Status(bool) [function] [call site] 00002
2 jxl::Span ::Span(unsigned char const*, unsigned long) [function] [call site] 00003
2 jxl::BitReader::BitReader >(jxl::Span const&) [function] [call site] 00004
3 jxl::Span ::data() const [function] [call site] 00005
3 jxl::Span ::data() const [function] [call site] 00006
3 jxl::Span ::data() const [function] [call site] 00007
3 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00008
4 jxl::Abort() [function] [call site] 00009
4 jxl::Abort() [function] [call site] 00010
4 jxl::Abort() [function] [call site] 00011
3 jxl::Abort() [function] [call site] 00012
2 jxl::BitReaderScopedCloser::BitReaderScopedCloser(jxl::BitReader*, jxl::Status*) [function] [call site] 00013
3 jxl::Abort() [function] [call site] 00014
3 jxl::Abort() [function] [call site] 00015
2 jxl::ANSCode::ANSCode() [function] [call site] 00016
3 jxl::LZ77Params::LZ77Params() [function] [call site] 00017
4 jxl::Fields::Fields() [function] [call site] 00018
4 jxl::HybridUintConfig::HybridUintConfig(unsigned int, unsigned int, unsigned int) [function] [call site] 00019
5 jxl::Abort() [function] [call site] 00020
4 jxl::Bundle::Init(jxl::Fields*) [function] [call site] 00021
5 jxl::(anonymous namespace)::InitVisitor::InitVisitor() [function] [call site] 00022
6 jxl::fields_internal::VisitorBase::VisitorBase() [function] [call site] 00023
7 jxl::Visitor::Visitor() [function] [call site] 00024
5 jxl::fields_internal::VisitorBase::Visit(jxl::Fields*) [function] [call site] 00025
6 jxl::Abort() [function] [call site] 00026
6 jxl::fields_internal::ExtensionStates::Push() [function] [call site] 00027
6 jxl::Status::operator bool() const [function] [call site] 00028
6 jxl::fields_internal::ExtensionStates::IsBegun() const [function] [call site] 00029
7 jxl::Status::Status(bool) [function] [call site] 00030
6 jxl::Status::operator bool() const [function] [call site] 00031
6 jxl::fields_internal::ExtensionStates::Pop() [function] [call site] 00032
6 jxl::Abort() [function] [call site] 00033
5 jxl::Status::operator bool() const [function] [call site] 00034
5 jxl::fields_internal::VisitorBase::~VisitorBase() [function] [call site] 00035
6 jxl::Abort() [function] [call site] 00036
6 jxl::Visitor::~Visitor() [function] [call site] 00037
2 jxl::DecodeHistograms(jxl::BitReader*, unsigned long, jxl::ANSCode*, std::__1::vector >*, bool) [function] [call site] 00038
3 jxl::Bundle::Read(jxl::BitReader*, jxl::Fields*) [function] [call site] 00039
4 jxl::(anonymous namespace)::ReadVisitor::ReadVisitor(jxl::BitReader*) [function] [call site] 00040
5 jxl::fields_internal::VisitorBase::VisitorBase() [function] [call site] 00041
4 jxl::fields_internal::VisitorBase::Visit(jxl::Fields*) [function] [call site] 00042
4 jxl::Status::operator bool() const [function] [call site] 00043
4 jxl::(anonymous namespace)::ReadVisitor::OK() const [function] [call site] 00044
5 jxl::Status::Status(bool) [function] [call site] 00045
4 jxl::fields_internal::VisitorBase::~VisitorBase() [function] [call site] 00046
3 jxl::Status::operator bool() const [function] [call site] 00047
3 jxl::DecodeUintConfig(unsigned long, jxl::HybridUintConfig*, jxl::BitReader*) [function] [call site] 00048
4 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00049
4 jxl::Abort() [function] [call site] 00050
4 jxl::Abort() [function] [call site] 00051
4 jxl::Abort() [function] [call site] 00052
4 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00053
4 jxl::Abort() [function] [call site] 00054
4 jxl::Abort() [function] [call site] 00055
4 jxl::Abort() [function] [call site] 00056
4 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00057
4 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00058
4 jxl::HybridUintConfig::HybridUintConfig(unsigned int, unsigned int, unsigned int) [function] [call site] 00059
3 jxl::Status::operator bool() const [function] [call site] 00060
3 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00061
3 jxl::DecodeContextMap(std::__1::vector >*, unsigned long*, jxl::BitReader*) [function] [call site] 00062
4 jxl::Abort() [function] [call site] 00063
4 jxl::Abort() [function] [call site] 00064
4 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00065
4 jxl::Abort() [function] [call site] 00066
4 jxl::Abort() [function] [call site] 00067
4 jxl::Abort() [function] [call site] 00068
4 jxl::ANSCode::ANSCode() [function] [call site] 00069
4 jxl::DecodeHistograms(jxl::BitReader*, unsigned long, jxl::ANSCode*, std::__1::vector >*, bool) [function] [call site] 00070
5 jxl::Status::operator bool() const [function] [call site] 00071
5 jxl::Abort() [function] [call site] 00072
5 jxl::DecodeUintConfigs(unsigned long, std::__1::vector >*, jxl::BitReader*) [function] [call site] 00073
6 jxl::DecodeUintConfig(unsigned long, jxl::HybridUintConfig*, jxl::BitReader*) [function] [call site] 00074
6 jxl::Status::operator bool() const [function] [call site] 00075
6 jxl::Status::Status(bool) [function] [call site] 00076
5 jxl::Status::operator bool() const [function] [call site] 00077
5 jxl::DecodeANSCodes(unsigned long, unsigned long, jxl::BitReader*, jxl::ANSCode*) [function] [call site] 00078
6 jxl::Abort() [function] [call site] 00079
6 jxl::(anonymous namespace)::DecodeVarLenUint16(jxl::BitReader*) [function] [call site] 00080
7 jxl::Abort() [function] [call site] 00081
6 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00082
6 jxl::HuffmanDecodingData::ReadFromBitStream(unsigned long, jxl::BitReader*) [function] [call site] 00083
7 jxl::Abort() [function] [call site] 00084
7 jxl::Abort() [function] [call site] 00085
7 jxl::ReadSimpleCode(unsigned long, jxl::BitReader*, jxl::HuffmanCode*)::{lambda(unsigned long, unsigned long)#1}::operator()(unsigned long, unsigned long) const [function] [call site] 00086
7 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00087
7 jxl::Abort() [function] [call site] 00088
7 jxl::Abort() [function] [call site] 00089
7 jxl::Abort() [function] [call site] 00090
7 jxl::ReadHuffmanCodeLengths(unsigned char const*, int, unsigned char*, jxl::BitReader*) [function] [call site] 00091
8 jxl::BuildHuffmanTable(jxl::HuffmanCode*, int, unsigned char const*, unsigned long, unsigned short*) [function] [call site] 00092
9 jxl::ReplicateValue(jxl::HuffmanCode*, int, int, jxl::HuffmanCode) [function] [call site] 00093
9 jxl::GetNextKey(int, int) [function] [call site] 00094
9 jxl::NextTableBitSize(unsigned short const*, unsigned long, int) [function] [call site] 00095
9 jxl::ReplicateValue(jxl::HuffmanCode*, int, int, jxl::HuffmanCode) [function] [call site] 00096
9 jxl::GetNextKey(int, int) [function] [call site] 00097
8 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00098
8 jxl::Abort() [function] [call site] 00099
8 jxl::Abort() [function] [call site] 00100
7 jxl::BuildHuffmanTable(jxl::HuffmanCode*, int, unsigned char const*, unsigned long, unsigned short*) [function] [call site] 00101
6 jxl::BitReader::AllReadsWithinBounds() [function] [call site] 00102
7 jxl::BitReader::TotalBitsConsumed() const [function] [call site] 00103
7 jxl::BitReader::TotalBitsConsumed() const [function] [call site] 00104
7 jxl::Status::Status(bool) [function] [call site] 00105
6 jxl::Status::operator bool() const [function] [call site] 00106
6 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00107
6 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00108
6 jxl::ANSCode::UpdateMaxNumBits(unsigned long, unsigned long) [function] [call site] 00109
6 jxl::Abort() [function] [call site] 00110
6 jxl::AllocateArray(unsigned long) [function] [call site] 00111
7 jxl::CacheAligned::Allocate(unsigned long) [function] [call site] 00112
8 jxl::CacheAligned::NextOffset() [function] [call site] 00113
6 jxl::(anonymous namespace)::ReadHistogram(int, std::__1::vector >*, jxl::BitReader*) [function] [call site] 00114
7 jxl::(anonymous namespace)::DecodeVarLenUint8(jxl::BitReader*) [function] [call site] 00115
7 jxl::Abort() [function] [call site] 00116
7 jxl::Status::Status(bool) [function] [call site] 00117
7 jxl::(anonymous namespace)::DecodeVarLenUint8(jxl::BitReader*) [function] [call site] 00118
7 jxl::CreateFlatHistogram(int, int) [function] [call site] 00119
8 jxl::Abort() [function] [call site] 00120
8 jxl::Abort() [function] [call site] 00121
7 jxl::Status::Status(bool) [function] [call site] 00122
7 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00123
7 jxl::(anonymous namespace)::DecodeVarLenUint8(jxl::BitReader*) [function] [call site] 00124
7 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00125
7 jxl::Abort() [function] [call site] 00126
7 jxl::Abort() [function] [call site] 00127
7 jxl::Abort() [function] [call site] 00128
7 jxl::(anonymous namespace)::DecodeVarLenUint8(jxl::BitReader*) [function] [call site] 00129
7 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00130
7 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00131
7 jxl::Abort() [function] [call site] 00132
7 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00133
7 jxl::Status::Status(bool) [function] [call site] 00134
6 jxl::Status::operator bool() const [function] [call site] 00135
6 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00136
6 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00137
6 jxl::ANSCode::UpdateMaxNumBits(unsigned long, unsigned long) [function] [call site] 00138
6 jxl::InitAliasTable(std::__1::vector >, unsigned int, unsigned long, jxl::AliasTable::Entry*) [function] [call site] 00139
7 jxl::Abort() [function] [call site] 00140
7 jxl::Abort() [function] [call site] 00141
7 jxl::Abort() [function] [call site] 00142
7 jxl::Abort() [function] [call site] 00143
6 jxl::Status::Status(bool) [function] [call site] 00144
5 jxl::Status::operator bool() const [function] [call site] 00145
5 jxl::Status::Status(bool) [function] [call site] 00146
4 jxl::Status::operator bool() const [function] [call site] 00147
4 jxl::ANSSymbolReader::ANSSymbolReader(jxl::ANSCode const*, jxl::BitReader*, unsigned long) [function] [call site] 00148
5 jxl::HybridUintConfig::HybridUintConfig(unsigned int, unsigned int, unsigned int) [function] [call site] 00149
5 jxl::Abort() [function] [call site] 00150
5 jxl::AllocateArray(unsigned long) [function] [call site] 00151
4 unsigned long jxl::ANSSymbolReader::ReadHybridUintClustered (unsigned long, jxl::BitReader*) [function] [call site] 00152
5 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00153
5 jxl::Abort() [function] [call site] 00154
5 jxl::HuffmanDecodingData::ReadSymbol(jxl::BitReader*) const [function] [call site] 00155
6 jxl::Abort() [function] [call site] 00156
6 jxl::Abort() [function] [call site] 00157
6 jxl::Abort() [function] [call site] 00158
6 jxl::Abort() [function] [call site] 00159
5 jxl::Abort() [function] [call site] 00160
5 jxl::Abort() [function] [call site] 00161
5 jxl::Abort() [function] [call site] 00162
5 jxl::Abort() [function] [call site] 00163
5 jxl::BitReader::BoundsCheckedRefill() [function] [call site] 00164
5 jxl::Abort() [function] [call site] 00165
4 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00166
4 jxl::ANSSymbolReader::CheckANSFinalState() const [function] [call site] 00167
4 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00168
4 jxl::InverseMoveToFrontTransform(unsigned char*, int) [function] [call site] 00169
5 jxl::N_SSE2::InverseMoveToFrontTransform(unsigned char*, int) [function] [call site] 00170
6 jxl::N_SSE2::MoveToFront(unsigned char*, unsigned char) [function] [call site] 00171
7 hwy::SizeTag<((hwy::detail::Relations ::is_signed+hwy::detail::Relations ::is_float)+hwy::detail::Relations ::is_bf16)<<(8)> hwy::TypeTag >() [function] [call site] 00172
4 jxl::ANSSymbolReader::~ANSSymbolReader() [function] [call site] 00173
4 jxl::(anonymous namespace)::VerifyContextMap(std::__1::vector > const&, unsigned long) [function] [call site] 00174
5 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00175
5 jxl::Status::Status(jxl::StatusCode) [function] [call site] 00176
5 jxl::Status::Status(bool) [function] [call site] 00177
2 jxl::Status::operator bool() const [function] [call site] 00178
2 jxl::ANSSymbolReader::ANSSymbolReader(jxl::ANSCode const*, jxl::BitReader*, unsigned long) [function] [call site] 00179
2 jxl::BitReader::TotalBitsConsumed() const [function] [call site] 00180
2 unsigned long jxl::DivCeil (unsigned long, unsigned long) [function] [call site] 00181
2 jxl::ANSSymbolReader::ReadHybridUint(unsigned long, jxl::BitReader*, std::__1::vector > const&) [function] [call site] 00182
3 unsigned long jxl::ANSSymbolReader::ReadHybridUintClustered (unsigned long, jxl::BitReader*) [function] [call site] 00183
2 jxl::ANSSymbolReader::~ANSSymbolReader() [function] [call site] 00184
2 jxl::BitReaderScopedCloser::~BitReaderScopedCloser() [function] [call site] 00185
3 jxl::BitReader::Close() [function] [call site] 00186
4 jxl::Abort() [function] [call site] 00187
4 jxl::Status::Status(bool) [function] [call site] 00188
4 jxl::BitReader::TotalBitsConsumed() const [function] [call site] 00189
4 jxl::BitReader::TotalBitsConsumed() const [function] [call site] 00190
4 jxl::Status::Status(bool) [function] [call site] 00191
3 jxl::Status::operator bool() const [function] [call site] 00192
3 __clang_call_terminate [call site] 00193
4 __cxa_begin_catch [call site] 00194