Fuzz introspector: fuzz_binary_decode
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
3 7 3 :

['isGood', 'exchangeBuffer', 'isTrue']

3 7 encodeWithExchangeBuffer call site: 00041 /src/open62541/src/ua_types_encoding_binary.c:104
0 11 3 :

['UInt32_encodeBinary', 'isGood', 'isTrue']

0 24 Variant_encodeBinaryWrapExtensionObject call site: 00000 /src/open62541/src/ua_types_encoding_binary.c:929
0 8 2 :

['UA_calcSizeBinary', 'UA_ByteString_allocBuffer']

4 30 UA_encodeBinary call site: 00036 /src/open62541/src/ua_types_encoding_binary.c:1507
0 0 None 4 4 addToMap call site: 00003 /src/open62541/tests/fuzz/custom_memory_manager.c:49
0 0 None 0 109 Variant_encodeBinary call site: 00000 /src/open62541/src/ua_types_encoding_binary.c:972
0 0 None 0 107 ExtensionObject_encodeBinary call site: 00000 /src/open62541/src/ua_types_encoding_binary.c:830
0 0 None 0 57 diagnosticInfoOrder call site: 00000 /src/open62541/src/ua_types.c:1809
0 0 None 0 54 copyStructure call site: 00000 /src/open62541/src/ua_types.c:1286
0 0 None 0 28 extensionObjectOrder call site: 00000 /src/open62541/src/ua_types.c:1622
0 0 None 0 28 extensionObjectOrder call site: 00000 /src/open62541/src/ua_types.c:1624
0 0 None 0 18 ExtensionObject_copy call site: 00000 /src/open62541/src/ua_types.c:677
0 0 None 0 18 clearStructure call site: 00000 /src/open62541/src/ua_types.c:1418

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 UA_memoryManager_setLimitFromLast4Bytes [function] [call site] 00001
2 UA_memoryManager_malloc [function] [call site] 00002
3 addToMap [function] [call site] 00003
4 pthread_mutex_lock [call site] 00004
4 pthread_mutex_unlock [call site] 00005
2 UA_memoryManager_free [function] [call site] 00006
3 removeFromMap [function] [call site] 00007
4 pthread_mutex_lock [call site] 00008
4 pthread_mutex_unlock [call site] 00009
4 pthread_mutex_unlock [call site] 00010
2 UA_memoryManager_calloc [function] [call site] 00011
3 calloc [call site] 00012
2 UA_memoryManager_realloc [function] [call site] 00014
3 removeFromMap [function] [call site] 00015
3 realloc [call site] 00016
1 UA_decodeBinary [function] [call site] 00019
2 UA_decodeBinaryInternal [function] [call site] 00020
1 UA_delete [function] [call site] 00022
1 UA_delete [function] [call site] 00024
1 UA_delete [function] [call site] 00027
1 UA_delete [function] [call site] 00028
1 __assert_fail [call site] 00030
1 UA_delete [function] [call site] 00031
1 UA_calcSizeBinary [function] [call site] 00032
1 UA_ByteString_allocBuffer [function] [call site] 00033
2 UA_ByteString_init [function] [call site] 00034
1 UA_delete [function] [call site] 00035
1 UA_encodeBinary [function] [call site] 00036
2 UA_calcSizeBinary [function] [call site] 00037
2 UA_ByteString_allocBuffer [function] [call site] 00038
2 UA_encodeBinaryInternal [function] [call site] 00039
3 isNonNull [function] [call site] 00040
3 encodeWithExchangeBuffer [function] [call site] 00041
4 __assert_fail [call site] 00042
4 exchangeBuffer [function] [call site] 00043
3 __assert_fail [call site] 00045
2 UA_ByteString_clear [function] [call site] 00046
1 __assert_fail [call site] 00048
1 UA_ByteString_clear(UA_String*) [function] [call site] 00049
1 UA_delete [function] [call site] 00050