Fuzz introspector: vpx_dec_fuzzer_vp9
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
176 176 1 :

['decode_tiles_row_wise_mt']

176 269 vp9_decode_frame call site: 00000 /src/libvpx/vp9/decoder/vp9_decodeframe.c:3024
123 146 6 :

['vp9_dec_free_row_mt_mem', 'pthread_mutex_init', 'vp9_jobq_alloc', 'mi_cols_aligned_to_sb', 'vp9_dec_alloc_row_mt_mem', 'vpx_calloc']

123 168 read_uncompressed_header call site: 00000 /src/libvpx/vp9/decoder/vp9_decodeframe.c:2828
34 34 3 :

['vp9_dec_free_row_mt_mem', 'vp9_jobq_deinit', 'pthread_mutex_destroy']

34 69 vp9_decoder_remove call site: 00000 /src/libvpx/vp9/decoder/vp9_decoder.c:239
0 64 3 :

['iadst8_sse2', 'vpx_idct8_sse2', 'round_shift_8x8']

0 70 vp9_highbd_iht8x8_64_add_sse4_1 call site: 00000 /src/libvpx/vp9/common/x86/vp9_highbd_iht8x8_add_sse4.c:194
0 58 4 :

['idct32_34_8x32_ssse3', 'highbd_load_pack_transpose_32bit_8x8.2676', 'transpose_16bit_8x8.2677', 'highbd_write_buffer_8.2678']

0 58 vpx_highbd_idct32x32_34_add_sse4_1 call site: 00000 /src/libvpx/vpx_dsp/x86/highbd_idct32x32_add_sse4.c:725
0 38 2 :

['idct4_sse2', 'iadst4_sse2']

0 44 vp9_highbd_iht4x4_16_add_sse4_1 call site: 00000 /src/libvpx/vp9/common/x86/vp9_highbd_iht4x4_add_sse4.c:96
0 28 2 :

['vpx_idct8_sse2', 'round_shift_8x8.2441']

0 28 vpx_highbd_idct8x8_64_add_sse4_1 call site: 00000 /src/libvpx/vpx_dsp/x86/highbd_idct8x8_add_sse4.c:109
0 20 1 :

['idct4_sse2']

0 20 vpx_highbd_idct4x4_16_add_sse4_1 call site: 00000 /src/libvpx/vpx_dsp/x86/highbd_idct4x4_add_sse4.c:28
0 7 1 :

['vpx_internal_error']

0 15 setup_tile_info call site: 00000 /src/libvpx/vp9/decoder/vp9_decodeframe.c:1640
0 2 1 :

['set_error_detail']

0 9 init_decoder call site: 00000 /src/libvpx/vp9/vp9_dx_iface.c:267
0 0 None 84 1252 decode_tiles call site: 00000 /src/libvpx/vp9/decoder/vp9_decodeframe.c:2095
0 0 None 12 19 reset call site: 00000 /src/libvpx/vpx_util/vpx_thread.c:143

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 vpx_codec_vp9_dx [function] [call site] 00001
1 vpx_codec_dec_init_ver [function] [call site] 00002
2 vpx_codec_destroy [function] [call site] 00003
1 vpx_codec_control_VP9D_SET_LOOP_FILTER_OPT(vpx_codec_ctx*, int, int) [function] [call site] 00004
2 vpx_codec_control_ [function] [call site] 00005
1 mem_get_le32_as_int(void const*) [function] [call site] 00006
1 vpx_codec_vp9_dx [function] [call site] 00007
1 vpx_codec_peek_stream_info [function] [call site] 00008
1 vpx_codec_decode [function] [call site] 00009
1 vpx_codec_get_frame [function] [call site] 00010
1 vpx_codec_destroy [function] [call site] 00011