Fuzz introspector: /work/build/../../src/perfetto/src/tracing/service/packet_stream_validator_fuzzer.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2031 2031 1 :

['perfetto::TracingServiceImpl::ReadBuffersIntoFile(unsigned long)']

2031 2064 perfetto::TracingServiceImpl::DisableTracingNotifyConsumerAndFlushFile(perfetto::TracingServiceImpl::TracingSession*) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1864
728 810 17 :

['perfetto::base::FlatSet ::begin() const', 'std::__1::basic_string , std::__1::allocator >::~basic_string()', 'perfetto::protos::pbzero::InternedString* perfetto::protos::pbzero::InternedData::add_kernel_symbols ()', 'perfetto::base::FlatSet ::size() const', 'bool std::__1::operator!=[abi:nn180100] (std::__1::__wrap_iter const&, std::__1::__wrap_iter const&)', 'perfetto::protos::pbzero::InternedString::set_str(std::__1::basic_string , std::__1::allocator >)', 'perfetto::protos::pbzero::TracePacket::set_sequence_flags(unsigned int)', 'perfetto::protos::pbzero::InternedString::set_iid(unsigned long)', 'perfetto::protos::pbzero::InternedData* perfetto::protos::pbzero::TracePacket::set_interned_data ()', 'perfetto::KernelSymbolMap::Lookup(unsigned long)', 'std::__1::basic_string , std::__1::allocator >::empty[abi:nn180100]() const', 'std::__1::__wrap_iter ::operator++[abi:nn180100]()', 'std::__1::basic_string , std::__1::allocator >::basic_string(std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::__wrap_iter ::operator*[abi:nn180100]() const', 'perfetto::LazyKernelSymbolizer::GetOrCreateKernelSymbolMap()', 'perfetto::base::FlatSet ::end() const', 'protozero::MessageHandle ::operator->() const']

817 903 perfetto::CpuReader::Bundler::FinalizeAndRunSymbolizer() call site: 00000 /work/build/../../src/perfetto/src/traced/probes/ftrace/cpu_reader.cc:358
401 401 1 :

['ZSTD_decompressSequencesLong']

401 401 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2142
382 382 1 :

['HUF_decompress4X_hufOnly_wksp']

382 382 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:196
366 366 1 :

['ZSTD_decompressSequencesSplitLitBuffer']

366 366 ZSTD_decompressBlock_internal call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:2154
286 286 1 :

['perfetto::TracingServiceImpl::PeriodicFlushTask(unsigned long, bool)']

328 930 perfetto::TracingServiceImpl::StartTracing(unsignedlong) call site: 00000 /work/build/../../src/perfetto/src/tracing/service/tracing_service_impl.cc:1340
271 271 2 :

['ERR_isError.43961', 'ZSTD_decompress_insertDictionary']

271 271 ZSTD_decompressBegin_usingDict call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress.c:1563
261 261 2 :

['HUF_decompress1X_usingDTable', 'HUF_decompress4X_usingDTable']

261 261 ZSTD_decodeLiteralsBlock call site: 00000 /work/build/../../src/perfetto/buildtools/zstd/lib/decompress/zstd_decompress_block.c:184
238 238 5 :

['_ZNSt3__16get_ifB8nn180100INS_6vectorIjNS_9allocatorIjEEEEJN8perfetto15trace_processor6RowMap5RangeENS6_9BitVectorES4_EEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE', 'perfetto::trace_processor::RowMap::NoVariantMatched()', 'std::__1::vector >::operator[][abi:nn180100](unsigned long) const', 'perfetto::trace_processor::BitVector::IndexOfNthSet(unsigned int) const', '_ZNSt3__16get_ifB8nn180100IN8perfetto15trace_processor9BitVectorEJNS2_6RowMap5RangeES3_NS_6vectorIjNS_9allocatorIjEEEEEEEu13__add_pointerIKT_EPKNS_7variantIJDpT0_EEE']

238 238 perfetto::trace_processor::RowMap::Get(unsignedint)const call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:220
218 220 5 :

['perfetto::trace_processor::RowMap::InsertIntoBitVector(perfetto::trace_processor::BitVector&, unsigned int)', 'perfetto::trace_processor::BitVector::~BitVector()', 'perfetto::trace_processor::BitVector::Resize(unsigned int, bool)', 'perfetto::trace_processor::BitVector::BitVector()', '_ZNSt3__17variantIJN8perfetto15trace_processor6RowMap5RangeENS2_9BitVectorENS_6vectorIjNS_9allocatorIjEEEEEEaSB8nn180100IS5_TnNS_9enable_ifIXnt9is_same_vIu14__remove_cvrefIT_ESA_EEiE4typeELi0ES5_Lm1ETnNSC_IXaa15is_assignable_vIRT1_SD_E18is_constructible_vISH_SD_EEiE4typeELi0EEERSA_OSD_']

218 220 perfetto::trace_processor::RowMap::Insert(unsignedint) call site: 00000 /work/build/../../src/perfetto/src/trace_processor/containers/row_map.h:302
218 218 1 :

['perfetto::trace_processor::TrackEventParser::EventImporter::ParseCounterEvent()']

218 218 perfetto::trace_processor::TrackEventParser::EventImporter::Import() call site: 00000 /work/build/../../src/perfetto/src/trace_processor/importers/proto/track_event_parser.cc:234
156 212 10 :

['unwindstack::MapInfo::offset() const', 'unwindstack::MapInfo::end() const', 'unwindstack::MapInfo::set_elf_start_offset(unsigned long)', 'unwindstack::Elf::IsValidElf(unwindstack::Memory*)', 'unwindstack::MapInfo::InitFileMemoryFromPreviousReadOnlyMap(unwindstack::MemoryFileAtOffset*)', 'unsigned long const& std::__1::max[abi:nn180100] (unsigned long const&, unsigned long const&)', 'unwindstack::MapInfo::set_elf_offset(unsigned long)', 'std::__1::shared_ptr ::get[abi:nn180100]() const', 'unwindstack::Elf::GetInfo(unwindstack::Memory*, unsigned long*)', 'unwindstack::MapInfo::start() const']

201 497 unwindstack::MapInfo::CreateFileMemory() call site: 00000 /work/build/../../src/perfetto/buildtools/android-unwinding/libunwindstack/MapInfo.cpp:111

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 perfetto::Slice::Slice(void const*, unsigned long) [function] [call site] 00001
1 perfetto::Slice::~Slice() [function] [call site] 00002
1 perfetto::PacketStreamValidator::Validate(std::__1::vector<perfetto::Slice, std::__1::allocator<perfetto::Slice> > const&) [function] [call site] 00003
2 perfetto::(anonymous namespace)::ProtoFieldParserFSM::ProtoFieldParserFSM() [function] [call site] 00004
2 perfetto::(anonymous namespace)::ProtoFieldParserFSM::Push(unsigned char) [function] [call site] 00005
3 unsigned long perfetto::base::ArraySize<unsigned int, 8ul>(unsigned int const (&) [8ul]) [function] [call site] 00006
2 perfetto::(anonymous namespace)::ProtoFieldParserFSM::valid() const [function] [call site] 00007
2 perfetto::(anonymous namespace)::ProtoFieldParserFSM::state() const [function] [call site] 00008
2 void perfetto::base::ignore_result<char [47], int, unsigned long>(char const (&) [47], int const&, unsigned long const&) [function] [call site] 00009