Fuzz introspector: fuzz_json_decode_encode
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
60 60 1 :

['addMultiArrayContentJSON']

60 138 Variant_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:1117
41 41 2 :

['UA_String_clear.5471', 'UA_ExpandedNodeId_print']

41 41 ExpandedNodeId_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:819
36 36 2 :

['UA_String_clear.5471', 'UA_NodeId_print']

36 36 NodeId_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:774
12 27 3 :

['writeJsonArrStart', 'writeJsonArrElm', 'writeJsonArrEnd']

12 27 Variant_encodeJsonWrapExtensionObject call site: 00000 /src/open62541/src/ua_types_encoding_json.c:1031
8 8 1 :

['arrayOrder']

8 8 variantOrder call site: 00000 /src/open62541/src/ua_types.c:1708
6 102 6 :

['writeJsonObjStart', 'writeJsonKey', 'String_encodeJson', 'writeJsonObjEnd', 'UA_StatusCode_name', 'UA_STRING.5487']

6 116 StatusCode_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:950
4 4 1 :

['UA_Variant_isScalar']

20 20 variantOrder call site: 00000 /src/open62541/src/ua_types.c:1686
2 2 1 :

['memcmp']

2 2 stringOrder call site: 00000 /src/open62541/src/ua_types.c:1581
0 57 1 :

['diagnosticInfoOrder']

0 57 diagnosticInfoOrder call site: 00000 /src/open62541/src/ua_types.c:1807
0 39 1 :

['String_encodeJson']

0 118 QualifiedName_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:919
0 39 1 :

['String_encodeJson']

0 104 NodeId_encodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:785
0 20 1 :

['variantOrder']

0 20 dataValueOrder call site: 00000 /src/open62541/src/ua_types.c:1721

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 UA_Variant_init(UA_Variant*) [function] [call site] 00001
1 UA_decodeJson [function] [call site] 00002
2 tokenize [function] [call site] 00003
3 cj5_parse [function] [call site] 00004
4 cj5__skip_comment [function] [call site] 00005
4 cj5__alloc_token [function] [call site] 00006
4 cj5__parse_primitive [function] [call site] 00007
5 cj5__parse_string [function] [call site] 00008
6 cj5__alloc_token [function] [call site] 00009
5 cj5__isrange [function] [call site] 00010
5 cj5__isrange [function] [call site] 00011
5 cj5__isrange [function] [call site] 00012
5 cj5__alloc_token [function] [call site] 00013
4 cj5__parse_key [function] [call site] 00014
5 cj5__parse_string [function] [call site] 00015
5 cj5__isrange [function] [call site] 00016
5 cj5__isrange [function] [call site] 00017
5 cj5__isrange [function] [call site] 00018
5 cj5__alloc_token [function] [call site] 00019
4 cj5__alloc_token [function] [call site] 00020
3 tokenize [function] [call site] 00021
2 UA_clear [function] [call site] 00022
1 UA_calcSizeJson [function] [call site] 00023
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00024
2 UA_clear [function] [call site] 00025
1 UA_ByteString_allocBuffer [function] [call site] 00026
2 UA_ByteString_init [function] [call site] 00027
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00028
1 UA_encodeJson [function] [call site] 00029
2 UA_calcSizeJson [function] [call site] 00030
2 UA_ByteString_allocBuffer [function] [call site] 00031
2 UA_ByteString_clear [function] [call site] 00032
3 UA_clear [function] [call site] 00033
1 __assert_fail [call site] 00034
1 UA_Variant_init(UA_Variant*) [function] [call site] 00035
1 UA_decodeJson [function] [call site] 00036
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00037
1 UA_ByteString_clear(UA_String*) [function] [call site] 00038
1 __assert_fail [call site] 00039
1 UA_ByteString_allocBuffer [function] [call site] 00040
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00041
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00042
1 UA_ByteString_clear(UA_String*) [function] [call site] 00043
1 UA_encodeJson [function] [call site] 00044
1 __assert_fail [call site] 00045
1 __assert_fail [call site] 00046
1 memcmp [call site] 00047
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00048
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00049
1 UA_ByteString_clear(UA_String*) [function] [call site] 00050
1 UA_ByteString_clear(UA_String*) [function] [call site] 00051