Fuzz introspector: fuzz_json_decode
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 11 2 :

['UA_copy', 'UA_Array_delete']

0 11 UA_Array_copy call site: 00000 /src/open62541/src/ua_types.c:1970
0 0 None 0 114 UA_decodeJson call site: 00002 /src/open62541/src/ua_types_encoding_json.c:2863
0 0 None 0 114 UA_decodeJson call site: 00002 /src/open62541/src/ua_types_encoding_json.c:2872
0 0 None 0 112 tokenize call site: 00004 /src/open62541/src/ua_types_encoding_json.c:2843
0 0 None 0 84 cj5_parse call site: 00004 /src/open62541/deps/cj5.c:354
0 0 None 0 47 DiagnosticInfoInner_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2616
0 0 None 0 36 ExtensionObject_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2515
0 0 None 0 36 Variant_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:2422
0 0 None 0 30 String_decodeJson call site: 00000 /src/open62541/src/ua_types_encoding_json.c:1725
0 0 None 0 18 clearStructure call site: 00000 /src/open62541/src/ua_types.c:1388
0 0 None 0 11 UA_Array_copy call site: 00000 /src/open62541/src/ua_types.c:1967
0 0 None 0 0 UA_unbase64 call site: 00000 /src/open62541/deps/base64.c:87

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 UA_Variant_init(UA_Variant*) [function] [call site] 00001
1 UA_decodeJson [function] [call site] 00002
2 tokenize [function] [call site] 00003
3 cj5_parse [function] [call site] 00004
4 cj5__skip_comment [function] [call site] 00005
4 cj5__alloc_token [function] [call site] 00006
4 cj5__parse_primitive [function] [call site] 00007
5 cj5__parse_string [function] [call site] 00008
6 cj5__alloc_token [function] [call site] 00009
5 cj5__isrange [function] [call site] 00010
5 cj5__isrange [function] [call site] 00011
5 cj5__isrange [function] [call site] 00012
5 cj5__alloc_token [function] [call site] 00013
4 cj5__parse_key [function] [call site] 00014
5 cj5__parse_string [function] [call site] 00015
5 cj5__isrange [function] [call site] 00016
5 cj5__isrange [function] [call site] 00017
5 cj5__isrange [function] [call site] 00018
5 cj5__alloc_token [function] [call site] 00019
4 cj5__alloc_token [function] [call site] 00020
3 tokenize [function] [call site] 00021
2 UA_clear [function] [call site] 00022
1 UA_Variant_clear(UA_Variant*) [function] [call site] 00023
2 UA_clear [function] [call site] 00024