Fuzz introspector: /work/build/../../src/perfetto/src/protozero/proto_decoder_fuzzer.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2031 2031 1 :

['perfetto::TracingServiceImpl::ReadBuffersIntoFile(unsigned long)']

2031 2064 perfetto::TracingServiceImpl::DisableTracingNotifyConsumerAndFlushFile(perfetto::TracingServiceImpl::TracingSession*) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1864
728 810 17 :

['perfetto::base::FlatSet ::begin() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'perfetto::protos::pbzero::InternedString* perfetto::protos::pbzero::InternedData::add_kernel_symbols ()', 'perfetto::base::FlatSet ::size() const', 'bool std::__1::operator!=[abi:nn180100] (std::__1::__wrap_iter const&, std::__1::__wrap_iter const&)', 'perfetto::protos::pbzero::InternedString::set_str(std::__1::basic_string , std::__1::allocator >)', 'perfetto::protos::pbzero::TracePacket::set_sequence_flags(unsigned int)', 'perfetto::protos::pbzero::InternedString::set_iid(unsigned long)', 'perfetto::protos::pbzero::InternedData* perfetto::protos::pbzero::TracePacket::set_interned_data ()', 'perfetto::KernelSymbolMap::Lookup(unsigned long)', 'std::__1::basic_string , std::__1::allocator >::empty[abi:nn180100]() const', 'std::__1::__wrap_iter ::operator++[abi:nn180100]()', 'std::__1::basic_string , std::__1::allocator >::basic_string(std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::__wrap_iter ::operator*[abi:nn180100]() const', 'perfetto::LazyKernelSymbolizer::GetOrCreateKernelSymbolMap()', 'perfetto::base::FlatSet ::end() const', 'protozero::MessageHandle ::operator->() const']

817 903 perfetto::CpuReader::Bundler::FinalizeAndRunSymbolizer() call site: 00000 /work/build/../../src/perfetto/src/traced/probes/ftrace/cpu_reader.cc:358
401 401 1 :

['ZSTD_decompressSequencesLong']

401 401 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2142
382 382 1 :

['HUF_decompress4X_hufOnly_wksp']

382 382 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:196
366 366 1 :

['ZSTD_decompressSequencesSplitLitBuffer']

366 366 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2154
286 286 1 :

['perfetto::TracingServiceImpl::PeriodicFlushTask(unsigned long, bool)']

328 930 perfetto::TracingServiceImpl::StartTracing(unsignedlong) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1340
271 271 2 :

['ERR_isError.43961', 'ZSTD_decompress_insertDictionary']

271 271 ZSTD_decompressBegin_usingDict call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress.c:1563
261 261 2 :

['HUF_decompress1X_usingDTable', 'HUF_decompress4X_usingDTable']

261 261 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:184
238 238 5 :

['_ZNSt3__16get_ifB8nn180100INS_6vectorIjNS_9allocatorIjEEEEJN8perfetto15trace_processor6RowMap5RangeENS6_9BitVectorES4_EEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE', 'perfetto::trace_processor::RowMap::NoVariantMatched()', 'std::__1::vector >::operator[][abi:nn180100](unsigned long) const', 'perfetto::trace_processor::BitVector::IndexOfNthSet(unsigned int) const', '_ZNSt3__16get_ifB8nn180100IN8perfetto15trace_processor9BitVectorEJNS2_6RowMap5RangeES3_NS_6vectorIjNS_9allocatorIjEEEEEEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE']

238 238 perfetto::trace_processor::RowMap::Get(unsignedint)const call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:220
218 220 5 :

['perfetto::trace_processor::RowMap::InsertIntoBitVector(perfetto::trace_processor::BitVector&, unsigned int)', 'perfetto::trace_processor::BitVector::~BitVector()', 'perfetto::trace_processor::BitVector::Resize(unsigned int, bool)', 'perfetto::trace_processor::BitVector::BitVector()', '_ZNSt3__17variantIJN8perfetto15trace_processor6RowMap5RangeENS2_9BitVectorENS_6vectorIjNS_9allocatorIjEEEEEEaSB8nn180100IS5_TnNS_9enable_ifIXnt9is_same_vIu14__remove_cvrefIT_ESA_EEiE4typeELi0ES5_Lm1ETnNSC_IXaa15is_assignable_vIRT1_SD_E18is_constructible_vISH_SD_EEiE4typeELi0EEERSA_OSD_']

218 220 perfetto::trace_processor::RowMap::Insert(unsignedint) call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:302
218 218 1 :

['perfetto::trace_processor::TrackEventParser::EventImporter::ParseCounterEvent()']

218 218 perfetto::trace_processor::TrackEventParser::EventImporter::Import() call site: 00000 /work/build/../../src/perfetto/src/trace_processor/importers/proto/track_event_parser.cc:234
156 212 10 :

['unwindstack::MapInfo::offset() const', 'unwindstack::MapInfo::end() const', 'unwindstack::MapInfo::set_elf_start_offset(unsigned long)', 'unwindstack::Elf::IsValidElf(unwindstack::Memory*)', 'unwindstack::MapInfo::InitFileMemoryFromPreviousReadOnlyMap(unwindstack::MemoryFileAtOffset*)', 'unsigned long const& std::__1::max[abi:nn180100] (unsigned long const&, unsigned long const&)', 'unwindstack::MapInfo::set_elf_offset(unsigned long)', 'std::__1::shared_ptr ::get[abi:nn180100]() const', 'unwindstack::Elf::GetInfo(unwindstack::Memory*, unsigned long*)', 'unwindstack::MapInfo::start() const']

201 497 unwindstack::MapInfo::CreateFileMemory() call site: 00000 /work/build/../../src/perfetto/buildtools/android-unwinding/libunwindstack/MapInfo.cpp:111

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 protozero::(anonymous namespace)::FuzzProtoDecoder(unsigned char const*, unsigned long) [function] [call site] 00001
2 protozero::ProtoDecoder::ProtoDecoder(void const*, unsigned long) [function] [call site] 00002
2 protozero::ProtoDecoder::ReadField() [function] [call site] 00003
3 protozero::(anonymous namespace)::ParseOneField(unsigned char const*, unsigned char const*) [function] [call site] 00004
4 protozero::proto_utils::ParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00005
5 PerfettoPbParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00006
4 protozero::proto_utils::ParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00007
4 protozero::proto_utils::ParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00008
4 void perfetto::base::ignore_result<char [29], unsigned char>(char const (&) [29], unsigned char const&) [function] [call site] 00009
4 void perfetto::base::ignore_result<char [38], unsigned int, unsigned int>(char const (&) [38], unsigned int const&, unsigned int const&) [function] [call site] 00010
4 void perfetto::base::ignore_result<char [48], unsigned int, unsigned long>(char const (&) [48], unsigned int const&, unsigned long const&) [function] [call site] 00011
4 protozero::Field::initialize(unsigned int, unsigned char, unsigned long, unsigned int) [function] [call site] 00012
2 protozero::Field::valid() const [function] [call site] 00013
2 protozero::Field::raw_int_value() const [function] [call site] 00014
2 protozero::TypedProtoDecoder<1, false>::TypedProtoDecoder(unsigned char const*, unsigned long) [function] [call site] 00015
3 protozero::TypedProtoDecoderBase::TypedProtoDecoderBase(protozero::Field*, unsigned int, unsigned int, unsigned char const*, unsigned long) [function] [call site] 00016
4 protozero::ProtoDecoder::ProtoDecoder(void const*, unsigned long) [function] [call site] 00017
3 protozero::TypedProtoDecoderBase::ParseAllFields() [function] [call site] 00018
4 protozero::(anonymous namespace)::ParseOneField(unsigned char const*, unsigned char const*) [function] [call site] 00019
4 protozero::Field::id() const [function] [call site] 00020
4 protozero::TypedProtoDecoderBase::ExpandHeapStorage() [function] [call site] 00021
5 perfetto::base::Basename(char const*) [function] [call site] 00022
6 perfetto::base::StrEnd(char const*) [function] [call site] 00023
7 perfetto::base::StrEnd(char const*) [function] [call site] 00024
6 perfetto::base::BasenameRecursive(char const*, char const*, char const*) [function] [call site] 00025
7 perfetto::base::BasenameRecursive(char const*, char const*, char const*) [function] [call site] 00026
5 __errno_location [call site] 00027
5 strerror [call site] 00028
5 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00029
6 vsnprintf [call site] 00030
6 snprintf [call site] 00031
6 __cxa_guard_acquire [call site] 00032
6 isatty [call site] 00033
6 __cxa_guard_release [call site] 00034
6 perfetto::base::StackString<10ul>::StackString(char const*, ...) [function] [call site] 00035
7 vsnprintf [call site] 00036
6 strlen [call site] 00037
6 perfetto::base::StackString<10ul>::len() const [function] [call site] 00038
6 perfetto::base::StackString<10ul>::c_str() const [function] [call site] 00039
6 perfetto::base::StackString<24ul>::StackString(char const*, ...) [function] [call site] 00040
6 perfetto::base::GetWallTimeMs() [function] [call site] 00041
7 perfetto::base::GetWallTimeNs() [function] [call site] 00042
8 perfetto::base::GetTimeInternalNs(int) [function] [call site] 00043
9 clock_gettime [call site] 00044
9 perfetto::base::Basename(char const*) [function] [call site] 00045
9 __errno_location [call site] 00046
9 strerror [call site] 00047
9 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00048
10 perfetto::base::StackString<32ul>::StackString(char const*, ...) [function] [call site] 00049
10 perfetto::base::StackString<32ul>::c_str() const [function] [call site] 00050
10 perfetto::base::StackString<24ul>::c_str() const [function] [call site] 00051
10 fprintf [call site] 00052
10 perfetto::base::StackString<32ul>::c_str() const [function] [call site] 00053
10 perfetto::base::StackString<24ul>::c_str() const [function] [call site] 00054
10 fprintf [call site] 00055
10 perfetto::base::StackString<32ul>::string_view() const [function] [call site] 00056
11 perfetto::base::StringView::StringView(char const*, unsigned long) [function] [call site] 00057
10 perfetto::base::StackString<24ul>::string_view() const [function] [call site] 00058
10 perfetto::base::StringView::StringView(char const*, unsigned long) [function] [call site] 00059
10 perfetto::base::LogRingBuffer::Append(perfetto::base::StringView, perfetto::base::StringView, perfetto::base::StringView) [function] [call site] 00060
11 perfetto::base::StringView::size() const [function] [call site] 00061
11 perfetto::base::StringView::data() const [function] [call site] 00062
11 perfetto::base::StringView::size() const [function] [call site] 00063
11 perfetto::base::StringView::data() const [function] [call site] 00064
11 perfetto::base::StringView::size() const [function] [call site] 00065
11 perfetto::base::StringView::data() const [function] [call site] 00066
11 snprintf [call site] 00067
9 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00068
10 perfetto::base::SerializeCrashKeys(char*, unsigned long) [function] [call site] 00069
11 perfetto::base::CrashKey::ToString(char*, unsigned long) [function] [call site] 00070
12 perfetto::base::SprintfTrunc(char*, unsigned long, char const*, ...) [function] [call site] 00071
13 vsnprintf [call site] 00072
12 perfetto::base::SprintfTrunc(char*, unsigned long, char const*, ...) [function] [call site] 00073
10 perfetto::base::LogRingBuffer::Read(char*, unsigned long) [function] [call site] 00074
10 fputs [call site] 00075
10 fputs [call site] 00076
10 fputs [call site] 00077
9 perfetto::base::FromPosixTimespec(timespec const&) [function] [call site] 00078
5 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00079
4 protozero::Field::valid() const [function] [call site] 00080
4 protozero::TypedProtoDecoderBase::ExpandHeapStorage() [function] [call site] 00081
2 protozero::TypedProtoDecoder<999, false>::TypedProtoDecoder(unsigned char const*, unsigned long) [function] [call site] 00082
2 protozero::TypedProtoDecoder<999, false>::~TypedProtoDecoder() [function] [call site] 00083
3 protozero::TypedProtoDecoderBase::~TypedProtoDecoderBase() [function] [call site] 00084
2 protozero::TypedProtoDecoder<1, false>::~TypedProtoDecoder() [function] [call site] 00085