Fuzz introspector: fuzz_mdns_message
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
23 23 1 :

['_q_answer']

23 23 _cache call site: 00084 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:520
0 0 None 39 142 mdnsd_in call site: 00064 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:758
0 0 None 39 142 mdnsd_in call site: 00066 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:762
0 0 None 23 23 _c_expire call site: 00072 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:420
0 0 None 8 8 _a_match call site: 00041 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:196
0 0 None 2 2 _r_next call site: 00036 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:164
0 0 None 2 2 _q_next call site: 00084 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:134
0 0 None 0 0 message_parse call site: 00001 /src/open62541/deps/mdnsd/libmdnsd/1035.c:457
0 0 None 0 0 message_parse call site: 00012 /src/open62541/deps/mdnsd/libmdnsd/1035.c:519
0 0 None 0 0 _label call site: 00009 /src/open62541/deps/mdnsd/libmdnsd/1035.c:148
0 0 None 0 0 mdnsd_in call site: 00034 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:681
0 0 None 0 0 mdnsd_in call site: 00061 /src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:752

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 mdnsd_new [function] [call site] 00031
2 calloc [call site] 00032
2 gettimeofday [call site] 00033
1 mdnsd_in [function] [call site] 00034
2 gettimeofday [call site] 00035
2 _r_next [function] [call site] 00036
3 _namehash [function] [call site] 00037
3 strcmp [call site] 00038
2 strcmp [call site] 00040
2 _a_match [function] [call site] 00041
3 strcmp [call site] 00042
3 strcmp [call site] 00043
3 strcmp [call site] 00044
3 memcmp [call site] 00045
2 _conflict [function] [call site] 00046
3 mdnsd_done [function] [call site] 00047
4 _r_send [function] [call site] 00050
5 _r_remove_lists [function] [call site] 00051
6 _r_remove_list [function] [call site] 00052
6 _r_remove_list [function] [call site] 00053
6 _r_remove_list [function] [call site] 00054
6 _r_remove_list [function] [call site] 00055
2 strcmp [call site] 00058
2 _u_push [function] [call site] 00061
3 calloc [call site] 00062
2 printf [call site] 00063
2 _conflict [function] [call site] 00066
2 _cache [function] [call site] 00067
3 _namehash [function] [call site] 00068
3 _c_next [function] [call site] 00069
4 _namehash [function] [call site] 00070
4 strcmp [call site] 00071
3 _c_expire [function] [call site] 00079
3 calloc [call site] 00080
3 strdup [call site] 00081
3 strdup [call site] 00082
3 strdup [call site] 00083
3 _q_next [function] [call site] 00084
4 _namehash [function] [call site] 00085
4 strcmp [call site] 00086
3 _q_answer [function] [call site] 00087
1 mdnsd_free [function] [call site] 00088