Fuzz introspector: oplist_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
6 6 1 :

['byte_array_grow']

6 6 byte_array_append call site: 00065 /src/libplist/src/bytearray.c:76
2 2 1 :

['fwrite']

2 2 byte_array_append call site: 00065 /src/libplist/src/bytearray.c:68
0 38 2 :

['node_destroy', 'node_attach']

0 38 node_create call site: 00009 /src/libplist/libcnary/node.c:64
0 13 1 :

['plist_free_data']

0 113 node_from_openstep call site: 00019 /src/libplist/src/oplist.c:741
0 13 1 :

['plist_free_data']

0 109 node_from_openstep call site: 00019 /src/libplist/src/oplist.c:776
0 0 None 0 912 plist_from_openstep call site: 00001 /src/libplist/src/oplist.c:900
0 0 None 0 216 plist_dict_set_item call site: 00000 /src/libplist/src/plist.c:864
0 0 None 0 96 node_from_openstep call site: 00019 /src/libplist/src/oplist.c:635
0 0 None 0 46 plist_array_append_item call site: 00028 /src/libplist/src/plist.c:681
0 0 None 0 13 node_insert call site: 00000 /src/libplist/libcnary/node.c:106
0 0 None 0 8 plist_get_string_ptr call site: 00106 /src/libplist/src/plist.c:1069
0 0 None 0 0 node_create call site: 00009 /src/libplist/libcnary/node.c:52

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 plist_from_openstep [function] [call site] 00001
2 node_from_openstep [function] [call site] 00002
3 fprintf [call site] 00003
3 parse_skip_ws [function] [call site] 00004
3 plist_new_plist_data [function] [call site] 00005
4 calloc [call site] 00006
3 plist_new_node [function] [call site] 00007
4 node_create [function] [call site] 00008
5 calloc [call site] 00009
5 node_attach [function] [call site] 00010
6 node_list_create [function] [call site] 00011
7 calloc [call site] 00012
6 node_list_add [function] [call site] 00013
5 printf [call site] 00014
5 node_destroy [function] [call site] 00015
6 node_list_remove [function] [call site] 00016
6 node_destroy [function] [call site] 00017
7 node_list_destroy [function] [call site] 00018
3 parse_dict_data [function] [call site] 00019
4 parse_skip_ws [function] [call site] 00020
4 node_from_openstep [function] [call site] 00021
5 fprintf [call site] 00022
5 fprintf [call site] 00023
5 parse_skip_ws [function] [call site] 00024
5 plist_new_node [function] [call site] 00025
5 parse_skip_ws [function] [call site] 00026
5 node_from_openstep [function] [call site] 00027
6 plist_array_append_item [function] [call site] 00028
7 plist_get_node_type [function] [call site] 00029
8 plist_get_data [function] [call site] 00030
7 node_attach [function] [call site] 00031
7 _plist_array_post_insert [function] [call site] 00032
8 ptr_array_insert [function] [call site] 00033
9 realloc [call site] 00034
8 ptr_array_new [function] [call site] 00035
8 node_first_child [function] [call site] 00036
8 ptr_array_add [function] [call site] 00037
9 ptr_array_insert [function] [call site] 00038
8 node_next_sibling [function] [call site] 00039
6 parse_skip_ws [function] [call site] 00040
6 fprintf [call site] 00041
6 plist_free [function] [call site] 00042
7 plist_free_node [function] [call site] 00043
8 node_detach [function] [call site] 00044
9 node_list_remove [function] [call site] 00045
8 plist_get_data [function] [call site] 00046
8 plist_free_data [function] [call site] 00047
9 ptr_array_free [function] [call site] 00048
9 hash_table_destroy [function] [call site] 00049
8 node_first_child [function] [call site] 00050
8 node_next_sibling [function] [call site] 00051
8 plist_free_node [function] [call site] 00052
9 node_destroy [function] [call site] 00053
6 fprintf [call site] 00054
6 fprintf [call site] 00055
6 parse_skip_ws [function] [call site] 00056
6 byte_array_new [function] [call site] 00057
6 parse_skip_ws [function] [call site] 00058
6 fprintf [call site] 00059
6 __ctype_b_loc [call site] 00060
6 fprintf [call site] 00061
6 fprintf [call site] 00062
6 __ctype_b_loc [call site] 00063
6 fprintf [call site] 00064
6 byte_array_append [function] [call site] 00065
7 byte_array_grow [function] [call site] 00066
8 realloc [call site] 00067
6 byte_array_free [function] [call site] 00068
6 plist_free_data [function] [call site] 00069
6 byte_array_free [function] [call site] 00070
6 plist_free_data [function] [call site] 00071
6 fprintf [call site] 00072
6 byte_array_free [function] [call site] 00073
6 plist_free_data [function] [call site] 00074
6 fprintf [call site] 00075
6 byte_array_free [function] [call site] 00076
6 plist_new_node [function] [call site] 00077
6 parse_skip_ws [function] [call site] 00078
6 plist_free_data [function] [call site] 00079
6 fprintf [call site] 00080
6 plist_free_data [function] [call site] 00081
6 fprintf [call site] 00082
6 __ctype_b_loc [call site] 00083
6 strncpy [call site] 00084
6 plist_new_node [function] [call site] 00085
6 parse_skip_ws [function] [call site] 00086
6 parse_skip_ws [function] [call site] 00087
6 strndup [call site] 00088
6 plist_new_node [function] [call site] 00089
6 parse_skip_ws [function] [call site] 00090
6 plist_free_data [function] [call site] 00091
6 fprintf [call site] 00092
6 plist_free [function] [call site] 00093
6 plist_free [function] [call site] 00094
4 plist_get_node_type [function] [call site] 00095
4 fprintf [call site] 00096
4 parse_skip_ws [function] [call site] 00097
4 fprintf [call site] 00098
4 fprintf [call site] 00099
4 fprintf [call site] 00100
4 node_from_openstep [function] [call site] 00101
4 fprintf [call site] 00102
4 parse_skip_ws [function] [call site] 00103
4 fprintf [call site] 00104
4 fprintf [call site] 00105
4 plist_get_string_ptr [function] [call site] 00106
5 plist_get_node_type [function] [call site] 00107
5 plist_get_data [function] [call site] 00108
4 plist_free [function] [call site] 00109
4 plist_free [function] [call site] 00110
4 plist_free [function] [call site] 00111
2 plist_new_dict [function] [call site] 00112
3 plist_new_plist_data [function] [call site] 00113
3 plist_new_node [function] [call site] 00114
2 plist_free [function] [call site] 00115
2 plist_new_dict [function] [call site] 00116
2 parse_dict_data [function] [call site] 00117
2 plist_free [function] [call site] 00118
2 fprintf [call site] 00119
1 plist_free [function] [call site] 00120