Fuzz introspector: fuzz_response
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
14 14 2 :

['mhd_panic', 'pthread_mutex_unlock']

14 14 MHD_response_add_header call site: 00031 /src/mhd2/src/mhd2/response_add_header.c:150
12 12 1 :

['mhd_panic']

55 93 MHD_response_destroy call site: 00141 /src/mhd2/src/mhd2/response_destroy.c:109
2 2 1 :

['pthread_mutex_lock']

16 35 MHD_response_add_header call site: 00029 /src/mhd2/src/mhd2/response_add_header.c:136
0 5 1 :

['mhd_response_remove_auth_digest_headers']

0 5 response_add_auth_digest_challenge_int call site: 00120 /src/mhd2/src/mhd2/response_auth_digest.c:471
0 0 None 43 43 MHD_response_destroy call site: 00142 /src/mhd2/src/mhd2/response_destroy.c:112
0 0 None 28 36 MHD_response_set_options call site: 00057 /src/mhd2/src/mhd2/response_set_options.c:38
0 0 None 14 78 MHD_response_add_auth_digest_challenge call site: 00103 /src/mhd2/src/mhd2/response_auth_digest.c:511
0 0 None 14 41 MHD_response_add_auth_basic_challenge call site: 00090 /src/mhd2/src/mhd2/response_auth_basic.c:161
0 0 None 14 22 MHD_response_set_options call site: 00059 /src/mhd2/src/mhd2/response_set_options.c:59
0 0 None 14 14 MHD_response_add_auth_basic_challenge call site: 00090 /src/mhd2/src/mhd2/response_auth_basic.c:168
0 0 None 14 14 MHD_response_add_auth_basic_challenge call site: 00090 /src/mhd2/src/mhd2/response_auth_basic.c:170
0 0 None 14 14 MHD_response_add_auth_digest_challenge call site: 00103 /src/mhd2/src/mhd2/response_auth_digest.c:518

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 pick_status_code(FuzzedDataProvider&) [function] [call site] 00001
1 create_response(FuzzedDataProvider&, MHD_HTTP_StatusCode) [function] [call site] 00002
2 MHD_response_from_buffer [function] [call site] 00003
3 response_create_basic [function] [call site] 00004
4 calloc [call site] 00005
4 calloc [call site] 00006
2 MHD_response_from_buffer [function] [call site] 00007
2 MHD_response_from_buffer_copy [function] [call site] 00008
3 response_create_basic [function] [call site] 00009
3 response_cntn_free_buf [function] [call site] 00010
3 response_create_basic [function] [call site] 00011
2 MHD_response_from_iovec [function] [call site] 00012
3 response_create_basic [function] [call site] 00013
3 calloc [call site] 00014
3 response_create_basic [function] [call site] 00015
2 mkstemp [call site] 00016
2 unlink [call site] 00017
2 write [call site] 00018
2 MHD_response_from_fd [function] [call site] 00019
3 response_create_basic [function] [call site] 00020
2 close [call site] 00021
2 pipe [call site] 00022
2 write [call site] 00023
2 close [call site] 00024
2 MHD_response_from_pipe [function] [call site] 00025
3 response_create_basic [function] [call site] 00026
2 close [call site] 00027
1 add_headers(FuzzedDataProvider&, MHD_Response*) [function] [call site] 00028
2 MHD_response_add_header [function] [call site] 00029
3 pthread_mutex_lock [call site] 00030
3 response_add_header_int [function] [call site] 00031
4 strlen [call site] 00032
4 strlen [call site] 00033
4 memchr [call site] 00034
4 memchr [call site] 00035
4 memchr [call site] 00036
4 memchr [call site] 00037
4 memchr [call site] 00038
4 memchr [call site] 00039
4 memchr [call site] 00040
4 response_add_header_no_check [function] [call site] 00041
3 pthread_mutex_unlock [call site] 00042
3 mhd_panic [function] [call site] 00043
4 fprintf [call site] 00044
4 fprintf [call site] 00045
4 fprintf [call site] 00046
4 abort [call site] 00047
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00048
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00049
2 MHD_response_add_header [function] [call site] 00050
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00051
2 MHD_response_add_predef_header [function] [call site] 00052
1 randomise_response_options(FuzzedDataProvider&, MHD_Response*) [function] [call site] 00053
2 ToMhdBool(bool) [function] [call site] 00054
2 MHD_R_OPTION_REUSABLE(MHD_Bool) [function] [call site] 00055
2 MHD_response_set_options [function] [call site] 00056
3 pthread_mutex_lock [call site] 00057
3 pthread_mutex_unlock [call site] 00058
3 mhd_panic [function] [call site] 00059
3 response_make_reusable [function] [call site] 00060
4 pthread_mutex_init [call site] 00061
4 pthread_mutex_destroy [call site] 00062
3 pthread_mutex_unlock [call site] 00063
3 mhd_panic [function] [call site] 00064
2 ToMhdBool(bool) [function] [call site] 00065
2 MHD_R_OPTION_HEAD_ONLY_RESPONSE(MHD_Bool) [function] [call site] 00066
2 MHD_response_set_options [function] [call site] 00067
2 ToMhdBool(bool) [function] [call site] 00068
2 MHD_R_OPTION_CHUNKED_ENC(MHD_Bool) [function] [call site] 00069
2 MHD_response_set_options [function] [call site] 00070
2 ToMhdBool(bool) [function] [call site] 00071
2 MHD_R_OPTION_CONN_CLOSE(MHD_Bool) [function] [call site] 00072
2 MHD_response_set_options [function] [call site] 00073
2 ToMhdBool(bool) [function] [call site] 00074
2 MHD_R_OPTION_HTTP_1_0_SERVER(MHD_Bool) [function] [call site] 00075
2 MHD_response_set_options [function] [call site] 00076
2 ToMhdBool(bool) [function] [call site] 00077
2 MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(MHD_Bool) [function] [call site] 00078
2 MHD_response_set_options [function] [call site] 00079
2 ToMhdBool(bool) [function] [call site] 00080
2 MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(MHD_Bool) [function] [call site] 00081
2 MHD_response_set_options [function] [call site] 00082
2 MHD_R_OPTION_TERMINATION_CALLBACK(void (*)(void*, MHD_RequestEndedData const*, void*), void*) [function] [call site] 00083
2 request_ended_cb(void*, MHD_RequestEndedData const*, void*) [function] [call site] 00084
2 MHD_response_set_options [function] [call site] 00085
1 add_auth(FuzzedDataProvider&, MHD_Response*, MHD_HTTP_StatusCode) [function] [call site] 00086
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00087
2 ToMhdBool(bool) [function] [call site] 00088
2 MHD_response_add_auth_basic_challenge [function] [call site] 00089
3 pthread_mutex_lock [call site] 00090
3 response_add_auth_basic_challenge_int [function] [call site] 00091
4 strlen [call site] 00092
4 memchr [call site] 00093
4 memchr [call site] 00094
4 mhd_str_quote [function] [call site] 00095
4 realloc [call site] 00096
3 pthread_mutex_unlock [call site] 00097
3 mhd_panic [function] [call site] 00098
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00099
2 ToMhdBool(bool) [function] [call site] 00100
2 ToMhdBool(bool) [function] [call site] 00101
2 MHD_response_add_auth_digest_challenge [function] [call site] 00102
3 pthread_mutex_lock [call site] 00103
3 response_add_auth_digest_challenge_int [function] [call site] 00104
4 strlen [call site] 00105
4 strlen [call site] 00106
4 strlen [call site] 00107
4 memchr [call site] 00108
4 memchr [call site] 00109
4 memchr [call site] 00110
4 memchr [call site] 00111
4 memchr [call site] 00112
4 memchr [call site] 00113
4 memchr [call site] 00114
4 response_add_auth_digest_challenge_alg [function] [call site] 00115
5 mhd_str_quote [function] [call site] 00116
5 mhd_str_quote [function] [call site] 00117
5 realloc [call site] 00118
4 response_add_auth_digest_challenge_alg [function] [call site] 00119
4 response_add_auth_digest_challenge_alg [function] [call site] 00120
4 mhd_response_remove_auth_digest_headers [function] [call site] 00121
3 pthread_mutex_unlock [call site] 00122
3 mhd_panic [function] [call site] 00123
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00124
2 ToMhdBool(bool) [function] [call site] 00125
2 ToMhdBool(bool) [function] [call site] 00126
2 ToMhdBool(bool) [function] [call site] 00127
2 MHD_response_add_auth_digest_challenge [function] [call site] 00128
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00129
2 ToMhdBool(bool) [function] [call site] 00130
2 MHD_response_add_auth_basic_challenge [function] [call site] 00131
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00132
2 ToMhdBool(bool) [function] [call site] 00133
2 MHD_response_add_auth_basic_challenge [function] [call site] 00134
2 safe_ascii(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, bool) [function] [call site] 00135
2 ToMhdBool(bool) [function] [call site] 00136
2 ToMhdBool(bool) [function] [call site] 00137
2 MHD_response_add_auth_digest_challenge [function] [call site] 00138
1 MHD_HTTP_status_code_to_string [function] [call site] 00139
1 MHD_status_code_to_string [call site] 00140
1 MHD_response_destroy [function] [call site] 00141
2 mhd_panic [function] [call site] 00142
2 response_full_deinit [function] [call site] 00143
3 mhd_response_remove_auth_digest_headers [function] [call site] 00144
3 mhd_response_remove_all_headers [function] [call site] 00145
3 mhd_response_deinit_reusable [function] [call site] 00146
4 pthread_mutex_destroy [call site] 00147
4 mhd_panic [function] [call site] 00148
3 mhd_response_deinit_content_data [function] [call site] 00149
4 close [call site] 00150
2 mhd_response_dec_use_count [function] [call site] 00151
3 mhd_panic [function] [call site] 00152
3 response_full_deinit [function] [call site] 00153