Fuzz introspector: decoder_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2793 2835 6 :

['WelsDec::CWelsDecoder::ReleaseBufferedReadyPictureReorder(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*, bool)', 'EventReset', 'EventPost', 'WelsDec::CWelsDecoder::ThreadDecodeFrameInternal(unsigned char const*, int, unsigned char**, TagBufferInfo*)', 'EventWait', 'WelsDec::CWelsDecoder::ReleaseBufferedReadyPictureNoReorder(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)']

2793 2835 WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:700
417 417 1 :

['WelsDec::CWelsDecoder::ThreadResetDecoder(WelsDec::TagWelsDecoderContext*&)']

417 417 WelsDec::CWelsDecoder::ResetDecoder(WelsDec::TagWelsDecoderContext*&) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:441
190 251 10 :

['WelsCommon::BsWriteSE(WelsCommon::TagBitStringAux*, int)', 'WelsCommon::CMemoryAlign::WelsFree(void*, char const*)', 'WelsCommon::BsRbspTrailingBits(WelsCommon::TagBitStringAux*)', 'WelsCommon::CMemoryAlign::WelsMallocz(unsigned int, char const*)', 'WelsCommon::InitBits(WelsCommon::TagBitStringAux*, unsigned char const*, int)', 'WelsCommon::BsWriteBits(WelsCommon::TagBitStringAux*, int, unsigned int)', 'WelsLog(TagLogContext*, int, char const*, ...)', 'WelsCommon::BsWriteOneBit(WelsCommon::TagBitStringAux*, unsigned int)', 'WelsDec::RBSP2EBSP(unsigned char*, unsigned char*, int)', 'WelsCommon::BsWriteUE(WelsCommon::TagBitStringAux*, unsigned int)']

194 351 WelsDec::ParseSps(WelsDec::TagWelsDecoderContext*,WelsCommon::TagBitStringAux*,int*,int*,unsignedchar*,int) call site: 00000 /src/openh264/codec/decoder/core/src/au_parser.cpp:1154
88 88 1 :

['WelsDec::ExpandBsLenBuffer(WelsDec::TagWelsDecoderContext*, int)']

88 180 WelsDec::DecodeFrameConstruction(WelsDec::TagWelsDecoderContext*,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/core/src/decoder_core.cpp:89
30 30 1 :

['WelsDec::ExpandNalUnitList(WelsDec::TagAccessUnits**, int, int, WelsCommon::CMemoryAlign*)']

30 30 WelsDec::MemGetNextNal(WelsDec::TagAccessUnits**,WelsCommon::CMemoryAlign*) call site: 00000 /src/openh264/codec/decoder/core/src/memmgr_nal_unit.cpp:134
29 29 1 :

['WelsDec::DoErrorConFrameCopy(WelsDec::TagWelsDecoderContext*)']

29 29 WelsDec::ImplementErrorCon(WelsDec::TagWelsDecoderContext*) call site: 00000 /src/openh264/codec/decoder/core/src/error_concealment.cpp:471
22 22 1 :

['EventWait']

42 3481 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:800
22 22 1 :

['EventWait']

22 461 WelsDec::GetColocatedMb(WelsDec::TagWelsDecoderContext*,unsignedint&,unsignedint&) call site: 00000 /src/openh264/codec/decoder/core/src/mv_pred.cpp:318
8 21 2 :

['EventPost', 'WelsDec::CWelsDecoder::BufferingReadyPicture(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)']

8 21 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:885
8 21 2 :

['EventPost', 'WelsDec::CWelsDecoder::BufferingReadyPicture(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)']

8 21 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:909
8 17 2 :

['EventCreate', 'WelsCommon::CMemoryAlign::WelsMallocz(unsigned int, char const*)']

8 17 WelsDec::AllocPicture(WelsDec::TagWelsDecoderContext*,int,int) call site: 00000 /src/openh264/codec/decoder/core/src/pic_queue.cpp:127
8 8 1 :

['EventPost']

8 49 WelsDec::DecodeFrameConstruction(WelsDec::TagWelsDecoderContext*,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/core/src/decoder_core.cpp:230

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 WelsCreateDecoder [function] [call site] 00001
2 WelsDec::CWelsDecoder::CWelsDecoder() [function] [call site] 00002
3 ISVCDecoder::ISVCDecoder() [function] [call site] 00003
3 welsCodecTrace::welsCodecTrace() [function] [call site] 00004
3 welsCodecTrace::SetCodecInstance(void*) [function] [call site] 00005
3 welsCodecTrace::SetTraceLevel(int) [function] [call site] 00006
3 WelsLog(TagLogContext*, int, char const*, ...) [function] [call site] 00007
4 WelsSnprintf [function] [call site] 00008
5 vsnprintf [call site] 00009
4 WelsSnprintf [function] [call site] 00010
4 WelsSnprintf [function] [call site] 00011
4 WelsSnprintf [function] [call site] 00012
4 WelsSnprintf [function] [call site] 00013
4 WelsStrcat [function] [call site] 00014
5 strlen [call site] 00015
5 WelsStrncpy [function] [call site] 00016
6 strncpy [call site] 00017
3 ResetReorderingPictureBuffers [function] [call site] 00018
3 GetCPUCount [function] [call site] 00019
4 WelsQueryLogicalProcessInfo [function] [call site] 00020
5 sched_getaffinity [call site] 00021
5 __sched_cpucount [call site] 00022
3 ISVCDecoder::~ISVCDecoder() [function] [call site] 00023
1 WelsDestroyDecoder [function] [call site] 00024