Fuzz introspector: /work/build/../../src/perfetto/src/protozero/filtering/message_filter_fuzzer.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2031 2031 1 :

['perfetto::TracingServiceImpl::ReadBuffersIntoFile(unsigned long)']

2031 2064 perfetto::TracingServiceImpl::DisableTracingNotifyConsumerAndFlushFile(perfetto::TracingServiceImpl::TracingSession*) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1864
728 810 17 :

['perfetto::base::FlatSet ::begin() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'perfetto::protos::pbzero::InternedString* perfetto::protos::pbzero::InternedData::add_kernel_symbols ()', 'perfetto::base::FlatSet ::size() const', 'bool std::__1::operator!=[abi:nn180100] (std::__1::__wrap_iter const&, std::__1::__wrap_iter const&)', 'perfetto::protos::pbzero::InternedString::set_str(std::__1::basic_string , std::__1::allocator >)', 'perfetto::protos::pbzero::TracePacket::set_sequence_flags(unsigned int)', 'perfetto::protos::pbzero::InternedString::set_iid(unsigned long)', 'perfetto::protos::pbzero::InternedData* perfetto::protos::pbzero::TracePacket::set_interned_data ()', 'perfetto::KernelSymbolMap::Lookup(unsigned long)', 'std::__1::basic_string , std::__1::allocator >::empty[abi:nn180100]() const', 'std::__1::__wrap_iter ::operator++[abi:nn180100]()', 'std::__1::basic_string , std::__1::allocator >::basic_string(std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::__wrap_iter ::operator*[abi:nn180100]() const', 'perfetto::LazyKernelSymbolizer::GetOrCreateKernelSymbolMap()', 'perfetto::base::FlatSet ::end() const', 'protozero::MessageHandle ::operator->() const']

817 903 perfetto::CpuReader::Bundler::FinalizeAndRunSymbolizer() call site: 00000 /work/build/../../src/perfetto/src/traced/probes/ftrace/cpu_reader.cc:358
401 401 1 :

['ZSTD_decompressSequencesLong']

401 401 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2142
382 382 1 :

['HUF_decompress4X_hufOnly_wksp']

382 382 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:196
366 366 1 :

['ZSTD_decompressSequencesSplitLitBuffer']

366 366 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2154
286 286 1 :

['perfetto::TracingServiceImpl::PeriodicFlushTask(unsigned long, bool)']

328 930 perfetto::TracingServiceImpl::StartTracing(unsignedlong) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1340
271 271 2 :

['ERR_isError.43961', 'ZSTD_decompress_insertDictionary']

271 271 ZSTD_decompressBegin_usingDict call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress.c:1563
261 261 2 :

['HUF_decompress1X_usingDTable', 'HUF_decompress4X_usingDTable']

261 261 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:184
238 238 5 :

['_ZNSt3__16get_ifB8nn180100INS_6vectorIjNS_9allocatorIjEEEEJN8perfetto15trace_processor6RowMap5RangeENS6_9BitVectorES4_EEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE', 'perfetto::trace_processor::RowMap::NoVariantMatched()', 'std::__1::vector >::operator[][abi:nn180100](unsigned long) const', 'perfetto::trace_processor::BitVector::IndexOfNthSet(unsigned int) const', '_ZNSt3__16get_ifB8nn180100IN8perfetto15trace_processor9BitVectorEJNS2_6RowMap5RangeES3_NS_6vectorIjNS_9allocatorIjEEEEEEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE']

238 238 perfetto::trace_processor::RowMap::Get(unsignedint)const call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:220
218 220 5 :

['perfetto::trace_processor::RowMap::InsertIntoBitVector(perfetto::trace_processor::BitVector&, unsigned int)', 'perfetto::trace_processor::BitVector::~BitVector()', 'perfetto::trace_processor::BitVector::Resize(unsigned int, bool)', 'perfetto::trace_processor::BitVector::BitVector()', '_ZNSt3__17variantIJN8perfetto15trace_processor6RowMap5RangeENS2_9BitVectorENS_6vectorIjNS_9allocatorIjEEEEEEaSB8nn180100IS5_TnNS_9enable_ifIXnt9is_same_vIu14__remove_cvrefIT_ESA_EEiE4typeELi0ES5_Lm1ETnNSC_IXaa15is_assignable_vIRT1_SD_E18is_constructible_vISH_SD_EEiE4typeELi0EEERSA_OSD_']

218 220 perfetto::trace_processor::RowMap::Insert(unsignedint) call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:302
218 218 1 :

['perfetto::trace_processor::TrackEventParser::EventImporter::ParseCounterEvent()']

218 218 perfetto::trace_processor::TrackEventParser::EventImporter::Import() call site: 00000 /work/build/../../src/perfetto/src/trace_processor/importers/proto/track_event_parser.cc:234
156 212 10 :

['unwindstack::MapInfo::offset() const', 'unwindstack::MapInfo::end() const', 'unwindstack::MapInfo::set_elf_start_offset(unsigned long)', 'unwindstack::Elf::IsValidElf(unwindstack::Memory*)', 'unwindstack::MapInfo::InitFileMemoryFromPreviousReadOnlyMap(unwindstack::MemoryFileAtOffset*)', 'unsigned long const& std::__1::max[abi:nn180100] (unsigned long const&, unsigned long const&)', 'unwindstack::MapInfo::set_elf_offset(unsigned long)', 'std::__1::shared_ptr ::get[abi:nn180100]() const', 'unwindstack::Elf::GetInfo(unwindstack::Memory*, unsigned long*)', 'unwindstack::MapInfo::start() const']

201 497 unwindstack::MapInfo::CreateFileMemory() call site: 00000 /work/build/../../src/perfetto/buildtools/android-unwinding/libunwindstack/MapInfo.cpp:111

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 protozero::(anonymous namespace)::FuzzMessageFilter(unsigned char const*, unsigned long) [function] [call site] 00001
2 protozero::MessageFilter::MessageFilter() [function] [call site] 00002
3 protozero::MessageFilter::Config::Config() [function] [call site] 00003
4 protozero::FilterBytecodeParser::FilterBytecodeParser() [function] [call site] 00004
4 protozero::StringFilter::StringFilter() [function] [call site] 00005
3 protozero::MessageFilter::MessageFilter(protozero::MessageFilter::Config) [function] [call site] 00006
4 protozero::MessageFilter::Config::Config(protozero::MessageFilter::Config&&) [function] [call site] 00007
5 protozero::FilterBytecodeParser::FilterBytecodeParser(protozero::FilterBytecodeParser&&) [function] [call site] 00008
5 protozero::StringFilter::StringFilter(protozero::StringFilter&&) [function] [call site] 00009
4 protozero::MessageTokenizer::MessageTokenizer() [function] [call site] 00010
3 protozero::MessageFilter::Config::~Config() [function] [call site] 00011
4 protozero::StringFilter::~StringFilter() [function] [call site] 00012
4 protozero::FilterBytecodeParser::~FilterBytecodeParser() [function] [call site] 00013
2 protozero::MessageFilter::LoadFilterBytecode(void const*, unsigned long) [function] [call site] 00014
3 protozero::MessageFilter::Config::LoadFilterBytecode(void const*, unsigned long) [function] [call site] 00015
4 protozero::FilterBytecodeParser::Load(void const*, unsigned long) [function] [call site] 00016
5 protozero::FilterBytecodeParser::Reset() [function] [call site] 00017
6 protozero::FilterBytecodeParser::FilterBytecodeParser() [function] [call site] 00018
6 protozero::FilterBytecodeParser::operator=(protozero::FilterBytecodeParser&&) [function] [call site] 00019
6 protozero::FilterBytecodeParser::~FilterBytecodeParser() [function] [call site] 00020
5 protozero::FilterBytecodeParser::LoadInternal(unsigned char const*, unsigned long) [function] [call site] 00021
6 protozero::PackedRepeatedFieldIterator<(protozero::proto_utils::ProtoWireType)0, unsigned int>::PackedRepeatedFieldIterator(unsigned char const*, unsigned long, bool*) [function] [call site] 00022
7 protozero::PackedRepeatedFieldIterator<(protozero::proto_utils::ProtoWireType)0, unsigned int>::operator++() [function] [call site] 00023
8 protozero::proto_utils::ParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00024
9 PerfettoPbParseVarInt(unsigned char const*, unsigned char const*, unsigned long*) [function] [call site] 00025
6 protozero::PackedRepeatedFieldIterator<(protozero::proto_utils::ProtoWireType)0, unsigned int>::operator bool() const [function] [call site] 00026
6 protozero::PackedRepeatedFieldIterator<(protozero::proto_utils::ProtoWireType)0, unsigned int>::operator*() const [function] [call site] 00027
6 protozero::PackedRepeatedFieldIterator<(protozero::proto_utils::ProtoWireType)0, unsigned int>::operator++() [function] [call site] 00028
6 perfetto::base::Hasher::Hasher() [function] [call site] 00029
6 _ZN8perfetto4base6Hasher6UpdateIjTnNSt3__19enable_ifIXsr3std13is_arithmeticIT_EE5valueEbE4typeELb1EEEvS5_ [function] [call site] 00030
7 perfetto::base::Hasher::Update(char const*, unsigned long) [function] [call site] 00031
6 perfetto::base::Hasher::digest() const [function] [call site] 00032
6 perfetto::base::Basename(char const*) [function] [call site] 00033
7 perfetto::base::StrEnd(char const*) [function] [call site] 00034
8 perfetto::base::StrEnd(char const*) [function] [call site] 00035
7 perfetto::base::BasenameRecursive(char const*, char const*, char const*) [function] [call site] 00036
8 perfetto::base::BasenameRecursive(char const*, char const*, char const*) [function] [call site] 00037
6 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00038
7 vsnprintf [call site] 00039
7 snprintf [call site] 00040
7 __cxa_guard_acquire [call site] 00041
7 isatty [call site] 00042
7 __cxa_guard_release [call site] 00043
7 perfetto::base::StackString<10ul>::StackString(char const*, ...) [function] [call site] 00044
8 vsnprintf [call site] 00045
7 strlen [call site] 00046
7 perfetto::base::StackString<10ul>::len() const [function] [call site] 00047
7 perfetto::base::StackString<10ul>::c_str() const [function] [call site] 00048
7 perfetto::base::StackString<24ul>::StackString(char const*, ...) [function] [call site] 00049
7 perfetto::base::GetWallTimeMs() [function] [call site] 00050
8 perfetto::base::GetWallTimeNs() [function] [call site] 00051
9 perfetto::base::GetTimeInternalNs(int) [function] [call site] 00052
10 clock_gettime [call site] 00053
10 perfetto::base::Basename(char const*) [function] [call site] 00054
10 __errno_location [call site] 00055
10 strerror [call site] 00056
10 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00057
11 perfetto::base::StackString<32ul>::StackString(char const*, ...) [function] [call site] 00058
11 perfetto::base::StackString<32ul>::c_str() const [function] [call site] 00059
11 perfetto::base::StackString<24ul>::c_str() const [function] [call site] 00060
11 fprintf [call site] 00061
11 perfetto::base::StackString<32ul>::c_str() const [function] [call site] 00062
11 perfetto::base::StackString<24ul>::c_str() const [function] [call site] 00063
11 fprintf [call site] 00064
11 perfetto::base::StackString<32ul>::string_view() const [function] [call site] 00065
12 perfetto::base::StringView::StringView(char const*, unsigned long) [function] [call site] 00066
11 perfetto::base::StackString<24ul>::string_view() const [function] [call site] 00067
11 perfetto::base::StringView::StringView(char const*, unsigned long) [function] [call site] 00068
11 perfetto::base::LogRingBuffer::Append(perfetto::base::StringView, perfetto::base::StringView, perfetto::base::StringView) [function] [call site] 00069
12 perfetto::base::StringView::size() const [function] [call site] 00070
12 perfetto::base::StringView::data() const [function] [call site] 00071
12 perfetto::base::StringView::size() const [function] [call site] 00072
12 perfetto::base::StringView::data() const [function] [call site] 00073
12 perfetto::base::StringView::size() const [function] [call site] 00074
12 perfetto::base::StringView::data() const [function] [call site] 00075
12 snprintf [call site] 00076
10 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00077
11 perfetto::base::SerializeCrashKeys(char*, unsigned long) [function] [call site] 00078
12 perfetto::base::CrashKey::ToString(char*, unsigned long) [function] [call site] 00079
13 perfetto::base::SprintfTrunc(char*, unsigned long, char const*, ...) [function] [call site] 00080
14 vsnprintf [call site] 00081
13 perfetto::base::SprintfTrunc(char*, unsigned long, char const*, ...) [function] [call site] 00082
11 perfetto::base::LogRingBuffer::Read(char*, unsigned long) [function] [call site] 00083
11 fputs [call site] 00084
11 fputs [call site] 00085
11 fputs [call site] 00086
10 perfetto::base::FromPosixTimespec(timespec const&) [function] [call site] 00087
6 void perfetto::base::ignore_result<char [48], unsigned long>(char const (&) [48], unsigned long const&) [function] [call site] 00088
6 void perfetto::base::ignore_result<char [53], unsigned long>(char const (&) [53], unsigned long const&) [function] [call site] 00089
6 protozero::FilterBytecodeParser::LoadInternal(unsigned char const*, unsigned long)::$_0::operator()(unsigned int, unsigned int) const [function] [call site] 00090
6 protozero::FilterBytecodeParser::LoadInternal(unsigned char const*, unsigned long)::$_1::operator()(unsigned int, unsigned int, unsigned int) const [function] [call site] 00091
6 void perfetto::base::ignore_result<char [46], unsigned long>(char const (&) [46], unsigned long const&) [function] [call site] 00092
6 protozero::FilterBytecodeParser::LoadInternal(unsigned char const*, unsigned long)::$_0::operator()(unsigned int, unsigned int) const [function] [call site] 00093
6 protozero::FilterBytecodeParser::LoadInternal(unsigned char const*, unsigned long)::$_1::operator()(unsigned int, unsigned int, unsigned int) const [function] [call site] 00094
6 void perfetto::base::ignore_result<char [47], unsigned long, unsigned int>(char const (&) [47], unsigned long const&, unsigned int const&) [function] [call site] 00095
6 void perfetto::base::ignore_result<char [65]>(char const (&) [65]) [function] [call site] 00096
6 void perfetto::base::ignore_result<char [72], unsigned int, unsigned long>(char const (&) [72], unsigned int const&, unsigned long const&) [function] [call site] 00097
5 protozero::FilterBytecodeParser::Reset() [function] [call site] 00098
2 perfetto::base::Basename(char const*) [function] [call site] 00099
2 __errno_location [call site] 00100
2 strerror [call site] 00101
2 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00102
2 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00103
2 protozero::MessageFilter::FilterMessage(void const*, unsigned long) [function] [call site] 00104
3 protozero::MessageFilter::FilterMessageFragments(protozero::MessageFilter::InputSlice const*, unsigned long) [function] [call site] 00105
4 protozero::MessageTokenizer::MessageTokenizer() [function] [call site] 00106
4 protozero::MessageFilter::Config::root_msg_index() const [function] [call site] 00107
4 protozero::MessageFilter::Config::string_filter() [function] [call site] 00108
4 protozero::StringFilter::MaybeFilter(char*, unsigned long) const [function] [call site] 00109
5 protozero::StringFilter::MaybeFilterInternal(char*, unsigned long) const [function] [call site] 00110
6 protozero::(anonymous namespace)::RedactMatches(std::__1::match_results<char*, std::__1::allocator<std::__1::sub_match<char*> > > const&) [function] [call site] 00111
7 perfetto::base::Basename(char const*) [function] [call site] 00112
7 __errno_location [call site] 00113
7 strerror [call site] 00114
7 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00115
7 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00116
6 protozero::(anonymous namespace)::FindAtracePayloadPtr(char const*, char const*) [function] [call site] 00117
7 memchr [call site] 00118
6 protozero::(anonymous namespace)::StartsWith(char const*, char const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00119
7 memcmp [call site] 00120
6 protozero::(anonymous namespace)::RedactMatches(std::__1::match_results<char*, std::__1::allocator<std::__1::sub_match<char*> > > const&) [function] [call site] 00121
6 protozero::(anonymous namespace)::FindAtracePayloadPtr(char const*, char const*) [function] [call site] 00122
6 protozero::(anonymous namespace)::StartsWith(char const*, char const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00123
6 protozero::(anonymous namespace)::RedactMatches(std::__1::match_results<char*, std::__1::allocator<std::__1::sub_match<char*> > > const&) [function] [call site] 00124
4 protozero::MessageTokenizer::Push(unsigned char) [function] [call site] 00125
4 protozero::MessageTokenizer::Token::valid() const [function] [call site] 00126
4 protozero::MessageFilter::Config::filter() const [function] [call site] 00127
4 protozero::FilterBytecodeParser::Query(unsigned int, unsigned int) const [function] [call site] 00128
4 protozero::FilterBytecodeParser::QueryResult::simple_field() const [function] [call site] 00129
4 protozero::(anonymous namespace)::AppendVarInt(unsigned int, unsigned long, unsigned char**) [function] [call site] 00130
5 protozero::proto_utils::MakeTagVarInt(unsigned int) [function] [call site] 00131
5 unsigned char* protozero::proto_utils::WriteVarInt<unsigned int>(unsigned int, unsigned char*) [function] [call site] 00132
6 _ZN9protozero11proto_utils33ExtendValueForVarIntSerializationIjEENSt3__113make_unsignedINS2_11conditionalIXsr3std11is_unsignedIT_EE5valueES5_lE4typeEE4typeES5_ [function] [call site] 00133
5 unsigned char* protozero::proto_utils::WriteVarInt<unsigned long>(unsigned long, unsigned char*) [function] [call site] 00134
6 _ZN9protozero11proto_utils33ExtendValueForVarIntSerializationImEENSt3__113make_unsignedINS2_11conditionalIXsr3std11is_unsignedIT_EE5valueES5_lE4typeEE4typeES5_ [function] [call site] 00135
4 void protozero::(anonymous namespace)::AppendFixed<unsigned int>(unsigned int, unsigned int, unsigned char**) [function] [call site] 00136
5 unsigned int protozero::proto_utils::MakeTagFixed<unsigned int>(unsigned int) [function] [call site] 00137
5 unsigned char* protozero::proto_utils::WriteVarInt<unsigned int>(unsigned int, unsigned char*) [function] [call site] 00138
4 void protozero::(anonymous namespace)::AppendFixed<unsigned long>(unsigned int, unsigned long, unsigned char**) [function] [call site] 00139
5 unsigned int protozero::proto_utils::MakeTagFixed<unsigned long>(unsigned int) [function] [call site] 00140
4 protozero::MessageFilter::SetUnrecoverableErrorState() [function] [call site] 00141
4 protozero::FilterBytecodeParser::QueryResult::nested_msg_field() const [function] [call site] 00142
4 protozero::(anonymous namespace)::AppendLenDelim(unsigned int, unsigned int, unsigned char**) [function] [call site] 00143
5 protozero::proto_utils::MakeTagLengthDelimited(unsigned int) [function] [call site] 00144
5 unsigned char* protozero::proto_utils::WriteVarInt<unsigned int>(unsigned int, unsigned char*) [function] [call site] 00145
5 unsigned char* protozero::proto_utils::WriteVarInt<unsigned int>(unsigned int, unsigned char*) [function] [call site] 00146
4 protozero::MessageFilter::out_written() [function] [call site] 00147
4 protozero::FilterBytecodeParser::QueryResult::filter_string_field() const [function] [call site] 00148
4 protozero::MessageFilter::IncrementCurrentFieldUsage(unsigned int, bool) [function] [call site] 00149
5 protozero::MessageFilter::IncrementCurrentFieldUsage(unsigned int, bool)::$_0::operator()(unsigned int) const [function] [call site] 00150
6 unsigned char* protozero::proto_utils::WriteVarInt<unsigned int>(unsigned int, unsigned char*) [function] [call site] 00151
5 protozero::MessageFilter::IncrementCurrentFieldUsage(unsigned int, bool)::$_0::operator()(unsigned int) const [function] [call site] 00152
4 protozero::proto_utils::WriteRedundantVarInt(unsigned int, unsigned char*, unsigned long) [function] [call site] 00153
4 perfetto::base::Basename(char const*) [function] [call site] 00154
4 __errno_location [call site] 00155
4 strerror [call site] 00156
4 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00157
4 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00158
4 protozero::MessageTokenizer::idle() const [function] [call site] 00159
4 perfetto::base::Basename(char const*) [function] [call site] 00160
4 __errno_location [call site] 00161
4 strerror [call site] 00162
4 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00163
4 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00164
4 protozero::MessageFilter::FilteredMessage::FilteredMessage(std::__1::unique_ptr<unsigned char [], std::__1::default_delete<unsigned char []> >, unsigned long) [function] [call site] 00165
4 protozero::MessageTokenizer::idle() const [function] [call site] 00166
4 protozero::MessageFilter::FilteredMessage::~FilteredMessage() [function] [call site] 00167
2 perfetto::base::Basename(char const*) [function] [call site] 00168
2 __errno_location [call site] 00169
2 strerror [call site] 00170
2 perfetto::base::LogMessage(perfetto::base::LogLev, char const*, int, char const*, ...) [function] [call site] 00171
2 perfetto::base::MaybeSerializeLastLogsForCrashReporting() [function] [call site] 00172
2 protozero::MessageFilter::FilteredMessage::~FilteredMessage() [function] [call site] 00173
2 protozero::MessageFilter::~MessageFilter() [function] [call site] 00174
3 protozero::MessageFilter::Config::~Config() [function] [call site] 00175