Fuzz introspector: xplist_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
8 8 2 :

['strlen', 'hash_table_lookup']

8 8 plist_dict_get_item call site: 00190 /src/libplist/src/plist.c:837
0 38 2 :

['node_destroy', 'node_attach']

0 38 node_create call site: 00052 /src/libplist/libcnary/node.c:64
0 0 None 50 1891 node_from_xml call site: 00041 /src/libplist/src/xplist.c:1109
0 0 None 50 1891 node_from_xml call site: 00102 /src/libplist/src/xplist.c:1166
0 0 None 50 1891 node_from_xml call site: 00128 /src/libplist/src/xplist.c:1217
0 0 None 50 1891 node_from_xml call site: 00164 /src/libplist/src/xplist.c:1294
0 0 None 50 1891 node_from_xml call site: 00174 /src/libplist/src/xplist.c:1328
0 0 None 50 1891 node_from_xml call site: 00231 /src/libplist/src/xplist.c:1395
0 0 None 17 216 plist_dict_set_item call site: 00186 /src/libplist/src/plist.c:864
0 0 None 7 7 plist_dict_set_item call site: 00212 /src/libplist/src/plist.c:885
0 0 None 2 41 text_parts_get_content call site: 00102 /src/libplist/src/xplist.c:917
0 0 None 2 4 plist_get_type_and_value call site: 00245 /src/libplist/src/plist.c:987

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 plist_from_xml [function] [call site] 00001
2 node_from_xml [function] [call site] 00002
3 parse_skip_ws [function] [call site] 00003
3 find_next [function] [call site] 00004
4 find_char [function] [call site] 00005
5 find_char [function] [call site] 00006
6 fprintf [call site] 00007
6 fprintf [call site] 00008
4 fprintf [call site] 00009
4 fprintf [call site] 00010
3 fprintf [call site] 00011
3 fprintf [call site] 00012
3 find_str [function] [call site] 00013
4 strncmp [call site] 00014
4 find_char [function] [call site] 00015
4 fprintf [call site] 00016
4 fprintf [call site] 00017
3 fprintf [call site] 00018
3 strncmp [call site] 00019
3 fprintf [call site] 00020
3 strncmp [call site] 00021
3 strncmp [call site] 00023
3 fprintf [call site] 00024
3 strncmp [call site] 00025
3 find_next [function] [call site] 00026
3 fprintf [call site] 00027
3 parse_skip_ws [function] [call site] 00028
3 strncmp [call site] 00030
3 fprintf [call site] 00031
3 find_next [function] [call site] 00032
3 fprintf [call site] 00033
3 find_next [function] [call site] 00034
3 fprintf [call site] 00035
3 strncpy [call site] 00036
3 find_next [function] [call site] 00037
3 fprintf [call site] 00038
3 fprintf [call site] 00039
3 strcmp [call site] 00040
3 fprintf [call site] 00041
3 fprintf [call site] 00042
3 strcmp [call site] 00043
3 fprintf [call site] 00044
3 fprintf [call site] 00045
3 strcmp [call site] 00046
3 fprintf [call site] 00047
3 plist_new_plist_data [function] [call site] 00048
4 calloc [call site] 00049
3 plist_new_node [function] [call site] 00050
4 node_create [function] [call site] 00051
5 calloc [call site] 00052
5 node_attach [function] [call site] 00053
6 node_list_create [function] [call site] 00054
7 calloc [call site] 00055
6 node_list_add [function] [call site] 00056
5 printf [call site] 00057
5 node_destroy [function] [call site] 00058
6 node_list_remove [function] [call site] 00059
6 node_destroy [function] [call site] 00060
7 node_list_destroy [function] [call site] 00061
3 strcmp [call site] 00062
3 strcmp [call site] 00063
3 strcmp [call site] 00064
3 get_text_parts [function] [call site] 00065
4 parse_skip_ws [function] [call site] 00066
4 find_char [function] [call site] 00067
4 fprintf [call site] 00068
4 fprintf [call site] 00069
4 fprintf [call site] 00070
4 text_part_append [function] [call site] 00071
5 __assert_fail [call site] 00072
5 text_part_init [function] [call site] 00073
4 text_part_init [function] [call site] 00074
4 strncmp [call site] 00076
4 fprintf [call site] 00077
4 fprintf [call site] 00078
4 strncmp [call site] 00079
4 text_part_append [function] [call site] 00080
4 text_part_init [function] [call site] 00081
4 strncmp [call site] 00083
4 fprintf [call site] 00084
4 text_part_append [function] [call site] 00085
4 text_part_init [function] [call site] 00086
4 find_next [function] [call site] 00087
4 fprintf [call site] 00088
4 find_next [function] [call site] 00089
4 fprintf [call site] 00090
4 find_next [function] [call site] 00091
4 fprintf [call site] 00092
4 strncmp [call site] 00093
4 fprintf [call site] 00094
4 parse_skip_ws [function] [call site] 00095
4 fprintf [call site] 00096
4 fprintf [call site] 00097
4 text_part_append [function] [call site] 00098
4 text_part_init [function] [call site] 00099
3 fprintf [call site] 00100
3 text_parts_free [function] [call site] 00101
3 text_parts_get_content [function] [call site] 00102
4 __assert_fail [call site] 00103
4 strncpy [call site] 00104
4 unescape_entities [function] [call site] 00105
5 fprintf [call site] 00106
5 strncmp [call site] 00107
5 strncmp [call site] 00108
5 strncmp [call site] 00109
5 strncmp [call site] 00110
5 strncmp [call site] 00111
5 fprintf [call site] 00112
5 fprintf [call site] 00113
5 strtoull [call site] 00114
5 fprintf [call site] 00115
5 strtoull [call site] 00116
5 fprintf [call site] 00117
5 fprintf [call site] 00118
5 fprintf [call site] 00119
3 fprintf [call site] 00120
3 text_parts_free [function] [call site] 00121
3 strtoull [call site] 00122
3 text_parts_free [function] [call site] 00123
3 strcmp [call site] 00124
3 get_text_parts [function] [call site] 00125
3 fprintf [call site] 00126
3 text_parts_free [function] [call site] 00127
3 text_parts_get_content [function] [call site] 00128
3 fprintf [call site] 00129
3 text_parts_free [function] [call site] 00130
3 atof [call site] 00131
3 text_parts_free [function] [call site] 00132
3 strcmp [call site] 00133
3 get_text_parts [function] [call site] 00134
3 strcmp [call site] 00135
3 get_text_parts [function] [call site] 00136
3 strcmp [call site] 00137
3 get_text_parts [function] [call site] 00138
3 fprintf [call site] 00139
3 text_parts_free [function] [call site] 00140
3 text_parts_get_content [function] [call site] 00141
3 text_parts_free [function] [call site] 00142
3 fprintf [call site] 00143
3 strcmp [call site] 00144
3 plist_get_node_type [function] [call site] 00145
4 plist_get_data [function] [call site] 00146
3 plist_free [function] [call site] 00147
4 plist_free_node [function] [call site] 00148
5 node_detach [function] [call site] 00149
6 node_list_remove [function] [call site] 00150
5 plist_get_data [function] [call site] 00151
5 plist_free_data [function] [call site] 00152
6 ptr_array_free [function] [call site] 00153
6 hash_table_destroy [function] [call site] 00154
5 node_first_child [function] [call site] 00155
5 node_next_sibling [function] [call site] 00156
5 plist_free_node [function] [call site] 00157
6 node_destroy [function] [call site] 00158
3 strdup [call site] 00159
3 strcmp [call site] 00160
3 get_text_parts [function] [call site] 00161
3 fprintf [call site] 00162
3 text_parts_free [function] [call site] 00163
3 text_parts_get_content [function] [call site] 00164
3 fprintf [call site] 00165
3 text_parts_free [function] [call site] 00166
3 base64decode [function] [call site] 00167
4 strlen [call site] 00168
3 text_parts_free [function] [call site] 00169
3 strcmp [call site] 00170
3 get_text_parts [function] [call site] 00171
3 fprintf [call site] 00172
3 text_parts_free [function] [call site] 00173
3 text_parts_get_content [function] [call site] 00174
3 fprintf [call site] 00175
3 text_parts_free [function] [call site] 00176
3 strncpy [call site] 00177
3 parse_date [function] [call site] 00178
4 strptime [call site] 00179
3 fprintf [call site] 00181
3 text_parts_free [function] [call site] 00182
3 fprintf [call site] 00183
3 plist_get_node_type [function] [call site] 00184
3 fprintf [call site] 00185
3 plist_dict_set_item [function] [call site] 00186
4 plist_get_node_type [function] [call site] 00187
4 plist_dict_get_item [function] [call site] 00188
5 plist_get_node_type [function] [call site] 00189
5 plist_get_data [function] [call site] 00190
5 hash_table_lookup [function] [call site] 00191
5 node_first_child [function] [call site] 00192
5 plist_get_data [function] [call site] 00193
5 plist_get_node_type [function] [call site] 00194
5 __assert_fail [call site] 00195
5 strcmp [call site] 00196
5 node_next_sibling [function] [call site] 00197
5 node_next_sibling [function] [call site] 00198
4 plist_free_node [function] [call site] 00199
4 __assert_fail [call site] 00200
4 node_insert [function] [call site] 00201
5 node_list_create [function] [call site] 00202
5 node_list_insert [function] [call site] 00203
6 node_list_add [function] [call site] 00204
4 node_prev_sibling [function] [call site] 00205
4 plist_new_key [function] [call site] 00206
5 plist_new_plist_data [function] [call site] 00207
5 strdup [call site] 00208
5 strlen [call site] 00209
5 plist_new_node [function] [call site] 00210
4 node_attach [function] [call site] 00211
4 node_attach [function] [call site] 00212
4 hash_table_insert [function] [call site] 00213
4 hash_table_new [function] [call site] 00214
4 dict_key_hash [function] [call site] 00215
4 node_first_child [function] [call site] 00216
4 node_next_sibling [function] [call site] 00217
4 hash_table_insert [function] [call site] 00218
4 node_next_sibling [function] [call site] 00219
3 plist_array_append_item [function] [call site] 00220
4 plist_get_node_type [function] [call site] 00221
4 node_attach [function] [call site] 00222
4 _plist_array_post_insert [function] [call site] 00223
5 ptr_array_insert [function] [call site] 00224
6 realloc [call site] 00225
5 ptr_array_new [function] [call site] 00226
5 node_first_child [function] [call site] 00227
5 ptr_array_add [function] [call site] 00228
6 ptr_array_insert [function] [call site] 00229
5 node_next_sibling [function] [call site] 00230
3 fprintf [call site] 00231
3 fprintf [call site] 00232
3 fprintf [call site] 00233
3 strcmp [call site] 00234
3 fprintf [call site] 00235
3 plist_free [function] [call site] 00236
3 fprintf [call site] 00237
3 plist_free [function] [call site] 00238
3 plist_free [function] [call site] 00239
3 plist_get_node_type [function] [call site] 00240
3 plist_dict_get_item [function] [call site] 00241
3 plist_get_node_type [function] [call site] 00242
3 plist_get_uint_val [function] [call site] 00243
4 plist_get_node_type [function] [call site] 00244
4 plist_get_type_and_value [function] [call site] 00245
5 plist_get_data [function] [call site] 00246
5 strdup [call site] 00247
4 __assert_fail [call site] 00248
3 plist_free [function] [call site] 00249
3 plist_new_uid [function] [call site] 00250
4 plist_new_plist_data [function] [call site] 00251
4 plist_new_node [function] [call site] 00252
1 plist_free [function] [call site] 00253