Fuzz introspector: jplist_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 38 2 :

['node_destroy', 'node_attach']

0 38 node_create call site: 00024 /src/libplist/libcnary/node.c:64
0 0 None 2 829 plist_from_json call site: 00001 /src/libplist/src/jplist.c:787
0 0 None 2 827 plist_from_json call site: 00003 /src/libplist/src/jplist.c:804
0 0 None 0 216 plist_dict_set_item call site: 00106 /src/libplist/src/plist.c:864
0 0 None 0 48 parse_array call site: 00073 /src/libplist/src/jplist.c:689
0 0 None 0 48 parse_object call site: 00081 /src/libplist/src/jplist.c:737
0 0 None 0 46 plist_array_append_item call site: 00093 /src/libplist/src/plist.c:681
0 0 None 0 13 node_insert call site: 00133 /src/libplist/libcnary/node.c:106
0 0 None 0 0 node_create call site: 00024 /src/libplist/libcnary/node.c:52
0 0 None 0 0 node_list_create call site: 00027 /src/libplist/libcnary/node_list.c:39
0 0 None 0 0 node_list_insert call site: 00136 /src/libplist/libcnary/node_list.c:99
0 0 None 0 0 node_list_insert call site: 00136 /src/libplist/libcnary/node_list.c:114

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 plist_from_json [function] [call site] 00001
2 jsmn_init [function] [call site] 00002
2 realloc [call site] 00003
2 fprintf [call site] 00004
2 jsmn_parse [function] [call site] 00005
3 jsmn_alloc_token [function] [call site] 00006
3 jsmn_parse_string [function] [call site] 00007
4 jsmn_alloc_token [function] [call site] 00008
4 jsmn_fill_token [function] [call site] 00009
3 jsmn_parse_primitive [function] [call site] 00010
4 jsmn_alloc_token [function] [call site] 00011
4 jsmn_fill_token [function] [call site] 00012
2 fprintf [call site] 00013
2 fprintf [call site] 00014
2 fprintf [call site] 00015
2 parse_primitive [function] [call site] 00016
3 fprintf [call site] 00017
3 strncmp [call site] 00018
3 plist_new_bool [function] [call site] 00019
4 plist_new_plist_data [function] [call site] 00020
5 calloc [call site] 00021
4 plist_new_node [function] [call site] 00022
5 node_create [function] [call site] 00023
6 calloc [call site] 00024
6 node_attach [function] [call site] 00025
7 node_list_create [function] [call site] 00026
8 calloc [call site] 00027
7 node_list_add [function] [call site] 00028
6 printf [call site] 00029
6 node_destroy [function] [call site] 00030
7 node_list_remove [function] [call site] 00031
7 node_destroy [function] [call site] 00032
8 node_list_destroy [function] [call site] 00033
3 strncmp [call site] 00034
3 plist_new_bool [function] [call site] 00035
3 strncmp [call site] 00036
3 plist_new_plist_data [function] [call site] 00037
3 plist_new_node [function] [call site] 00038
3 __ctype_b_loc [call site] 00039
3 parse_decimal [function] [call site] 00040
4 __ctype_b_loc [call site] 00041
4 __ctype_b_loc [call site] 00042
3 plist_new_int [function] [call site] 00043
4 plist_new_plist_data [function] [call site] 00044
4 plist_new_node [function] [call site] 00045
3 plist_new_uint [function] [call site] 00046
4 plist_new_plist_data [function] [call site] 00047
4 plist_new_node [function] [call site] 00048
3 __ctype_b_loc [call site] 00049
3 __ctype_b_loc [call site] 00050
3 __ctype_b_loc [call site] 00051
3 parse_decimal [function] [call site] 00052
3 pow [call site] 00053
3 fprintf [call site] 00054
3 fprintf [call site] 00055
3 plist_new_real [function] [call site] 00056
4 plist_new_plist_data [function] [call site] 00057
4 plist_new_node [function] [call site] 00058
3 fprintf [call site] 00059
3 fprintf [call site] 00060
2 parse_string [function] [call site] 00061
3 fprintf [call site] 00062
3 unescape_string [function] [call site] 00063
4 strndup [call site] 00064
4 fprintf [call site] 00065
4 __ctype_b_loc [call site] 00066
4 fprintf [call site] 00067
4 fprintf [call site] 00068
3 plist_new_plist_data [function] [call site] 00069
3 plist_new_node [function] [call site] 00070
2 parse_array [function] [call site] 00071
3 fprintf [call site] 00072
3 plist_new_array [function] [call site] 00073
4 plist_new_plist_data [function] [call site] 00074
4 plist_new_node [function] [call site] 00075
3 fprintf [call site] 00076
3 plist_free [function] [call site] 00077
3 parse_object [function] [call site] 00078
4 fprintf [call site] 00079
4 fprintf [call site] 00080
4 plist_new_dict [function] [call site] 00081
5 plist_new_plist_data [function] [call site] 00082
5 plist_new_node [function] [call site] 00083
4 fprintf [call site] 00084
4 plist_free [function] [call site] 00085
4 unescape_string [function] [call site] 00086
4 plist_free [function] [call site] 00087
4 parse_object [function] [call site] 00088
5 parse_array [function] [call site] 00089
6 parse_array [function] [call site] 00090
7 parse_string [function] [call site] 00091
7 parse_primitive [function] [call site] 00092
7 plist_array_append_item [function] [call site] 00093
8 node_attach [function] [call site] 00094
8 _plist_array_post_insert [function] [call site] 00095
9 ptr_array_insert [function] [call site] 00096
10 realloc [call site] 00097
9 ptr_array_new [function] [call site] 00098
9 node_first_child [function] [call site] 00099
9 ptr_array_add [function] [call site] 00100
10 ptr_array_insert [function] [call site] 00101
9 node_next_sibling [function] [call site] 00102
7 plist_free [function] [call site] 00103
5 parse_string [function] [call site] 00104
5 parse_primitive [function] [call site] 00105
5 plist_dict_set_item [function] [call site] 00106
6 plist_get_node_type [function] [call site] 00107
7 plist_get_data [function] [call site] 00108
6 plist_dict_get_item [function] [call site] 00109
7 plist_get_node_type [function] [call site] 00110
7 plist_get_data [function] [call site] 00111
7 strlen [call site] 00112
7 hash_table_lookup [function] [call site] 00113
7 node_first_child [function] [call site] 00114
7 plist_get_data [function] [call site] 00115
7 plist_get_node_type [function] [call site] 00116
7 __assert_fail [call site] 00117
7 strcmp [call site] 00118
7 node_next_sibling [function] [call site] 00119
7 node_next_sibling [function] [call site] 00120
6 plist_free_node [function] [call site] 00121
7 node_detach [function] [call site] 00122
8 node_list_remove [function] [call site] 00123
7 plist_get_data [function] [call site] 00124
7 plist_free_data [function] [call site] 00125
8 ptr_array_free [function] [call site] 00126
8 hash_table_destroy [function] [call site] 00127
7 node_first_child [function] [call site] 00128
7 node_next_sibling [function] [call site] 00129
7 plist_free_node [function] [call site] 00130
8 node_destroy [function] [call site] 00131
6 __assert_fail [call site] 00132
6 node_insert [function] [call site] 00133
7 node_list_create [function] [call site] 00134
7 node_list_insert [function] [call site] 00135
8 node_list_add [function] [call site] 00136
6 node_prev_sibling [function] [call site] 00137
6 plist_new_key [function] [call site] 00138
7 plist_new_plist_data [function] [call site] 00139
7 strdup [call site] 00140
7 strlen [call site] 00141
7 plist_new_node [function] [call site] 00142
6 node_attach [function] [call site] 00143
6 node_attach [function] [call site] 00144
6 hash_table_insert [function] [call site] 00145
6 hash_table_new [function] [call site] 00146
6 dict_key_hash [function] [call site] 00147
6 node_first_child [function] [call site] 00148
6 node_next_sibling [function] [call site] 00149
6 hash_table_insert [function] [call site] 00150
6 node_next_sibling [function] [call site] 00151
5 plist_free [function] [call site] 00152
5 fprintf [call site] 00153
5 plist_free [function] [call site] 00154
2 parse_object [function] [call site] 00155
1 plist_free [function] [call site] 00156