Fuzz introspector: decoder_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2800 2842 6 :

['WelsDec::CWelsDecoder::ReleaseBufferedReadyPictureReorder(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*, bool)', 'WelsDec::CWelsDecoder::ReleaseBufferedReadyPictureNoReorder(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)', 'EventWait', 'EventReset', 'EventPost', 'WelsDec::CWelsDecoder::ThreadDecodeFrameInternal(unsigned char const*, int, unsigned char**, TagBufferInfo*)']

2800 2842 WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:700
178 251 10 :

['WelsCommon::CMemoryAlign::WelsMallocz(unsigned int, char const*)', 'WelsCommon::BsRbspTrailingBits(WelsCommon::TagBitStringAux*)', 'WelsCommon::BsWriteUE(WelsCommon::TagBitStringAux*, unsigned int)', 'WelsDec::RBSP2EBSP(unsigned char*, unsigned char*, int)', 'WelsCommon::BsWriteBits(WelsCommon::TagBitStringAux*, int, unsigned int)', 'WelsCommon::CMemoryAlign::WelsFree(void*, char const*)', 'WelsLog(TagLogContext*, int, char const*, ...)', 'WelsCommon::BsWriteSE(WelsCommon::TagBitStringAux*, int)', 'WelsCommon::BsWriteOneBit(WelsCommon::TagBitStringAux*, unsigned int)', 'WelsCommon::InitBits(WelsCommon::TagBitStringAux*, unsigned char const*, int)']

182 351 WelsDec::ParseSps(WelsDec::TagWelsDecoderContext*,WelsCommon::TagBitStringAux*,int*,int*,unsignedchar*,int) call site: 00000 /src/openh264/codec/decoder/core/src/au_parser.cpp:1154
22 22 1 :

['EventWait']

42 3493 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:800
22 22 1 :

['EventWait']

22 461 WelsDec::GetColocatedMb(WelsDec::TagWelsDecoderContext*,unsignedint&,unsignedint&) call site: 00000 /src/openh264/codec/decoder/core/src/mv_pred.cpp:318
8 21 2 :

['EventPost', 'WelsDec::CWelsDecoder::BufferingReadyPicture(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)']

8 21 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:885
8 21 2 :

['EventPost', 'WelsDec::CWelsDecoder::BufferingReadyPicture(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*)']

8 21 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:909
8 17 2 :

['WelsCommon::CMemoryAlign::WelsMallocz(unsigned int, char const*)', 'EventCreate']

8 17 WelsDec::AllocPicture(WelsDec::TagWelsDecoderContext*,int,int) call site: 00000 /src/openh264/codec/decoder/core/src/pic_queue.cpp:127
8 8 1 :

['EventPost']

8 49 WelsDec::DecodeFrameConstruction(WelsDec::TagWelsDecoderContext*,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/core/src/decoder_core.cpp:230
8 8 1 :

['EventPost']

8 8 WelsDec::DecodeCurrentAccessUnit(WelsDec::TagWelsDecoderContext*,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/core/src/decoder_core.cpp:2827
6 6 1 :

['EventDestroy']

6 18 WelsDec::FreePicture(WelsDec::SPicture*,WelsCommon::CMemoryAlign*) call site: 00000 /src/openh264/codec/decoder/core/src/pic_queue.cpp:172
4 4 1 :

['WelsDec::PrefetchLastPicForThread(WelsDec::TagPicBuff*, int const&)']

71 2036 WelsDec::DecodeCurrentAccessUnit(WelsDec::TagWelsDecoderContext*,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/core/src/decoder_core.cpp:2504
2 2 1 :

['ResetDecStatNums']

10 125 WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext*,unsignedcharconst*,int,unsignedchar**,TagBufferInfo*) call site: 00000 /src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp:862

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 WelsCreateDecoder [function] [call site] 00001
2 WelsDec::CWelsDecoder::CWelsDecoder() [function] [call site] 00002
3 ISVCDecoder::ISVCDecoder() [function] [call site] 00003
3 welsCodecTrace::welsCodecTrace() [function] [call site] 00004
3 welsCodecTrace::SetCodecInstance(void*) [function] [call site] 00005
3 welsCodecTrace::SetTraceLevel(int) [function] [call site] 00006
3 WelsLog(TagLogContext*, int, char const*, ...) [function] [call site] 00007
4 WelsSnprintf [function] [call site] 00008
5 vsnprintf [call site] 00009
4 WelsSnprintf [function] [call site] 00010
4 WelsSnprintf [function] [call site] 00011
4 WelsSnprintf [function] [call site] 00012
4 WelsSnprintf [function] [call site] 00013
4 WelsStrcat [function] [call site] 00014
5 strlen [call site] 00015
5 WelsStrncpy [function] [call site] 00016
6 strncpy [call site] 00017
3 ResetReorderingPictureBuffers [function] [call site] 00018
3 GetCPUCount [function] [call site] 00019
4 WelsQueryLogicalProcessInfo [function] [call site] 00020
5 sched_getaffinity [call site] 00021
5 __sched_cpucount [call site] 00022
3 ISVCDecoder::~ISVCDecoder() [function] [call site] 00023
1 WelsDestroyDecoder [function] [call site] 00024