Fuzz introspector: fuzz_json_decode
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 11 2 :

['UA_Array_delete', 'UA_copy']

0 11 UA_Array_copy call site: 00000 /src/open62541/src/ua_types.c:1970
0 0 None 0 191 Variant_decodeJsonUnwrapExtensionObject call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2457
0 0 None 0 114 UA_decodeJson call site: 00002 /src/open62541/src/ua_types_encoding_json.c:2767
0 0 None 0 114 UA_decodeJson call site: 00002 /src/open62541/src/ua_types_encoding_json.c:2776
0 0 None 0 112 tokenize call site: 00004 /src/open62541/src/ua_types_encoding_json.c:2747
0 0 None 0 84 cj5_parse call site: 00004 /src/open62541/deps/cj5.c:354
0 0 None 0 47 DiagnosticInfoInner_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2505
0 0 None 0 40 Variant_decodeJsonUnwrapExtensionObject call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2443
0 0 None 0 38 ExtensionObject_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2379
0 0 None 0 38 Variant_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2254
0 0 None 0 30 String_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:1733
0 0 None 0 18 clearStructure call site: 00000 /src/open62541/src/ua_types.c:1418

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 UA_Variant_init(UA_Variant*) [function] [call site] 00001
1 UA_decodeJson [function] [call site] 00002
2 tokenize [function] [call site] 00003
3 cj5_parse [function] [call site] 00004
4 cj5__skip_comment [function] [call site] 00005
4 cj5__alloc_token [function] [call site] 00006
4 cj5__parse_primitive [function] [call site] 00007
5 cj5__parse_string [function] [call site] 00008
6 cj5__alloc_token [function] [call site] 00009
5 cj5__isrange [function] [call site] 00010
5 cj5__isrange [function] [call site] 00011
5 cj5__isrange [function] [call site] 00012
5 cj5__alloc_token [function] [call site] 00013
4 cj5__parse_key [function] [call site] 00014
5 cj5__parse_string [function] [call site] 00015
5 cj5__isrange [function] [call site] 00016
5 cj5__isrange [function] [call site] 00017
5 cj5__isrange [function] [call site] 00018
5 cj5__alloc_token [function] [call site] 00019
4 cj5__alloc_token [function] [call site] 00020
3 tokenize [function] [call site] 00021
2 UA_clear [function] [call site] 00022
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00023
2 UA_clear [function] [call site] 00024