Fuzz introspector: fuzz_parse
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 36 2 :

['pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&)', 'pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long)']

0 42 pugi::impl::(anonymousnamespace)::strconv_pcdata_impl ::parse(char*) call site /src/pugixml/src/pugixml.cpp:2708
0 0 None 0 323 pugi::impl::(anonymousnamespace)::xml_parser::parse_tree(char*,pugi::xml_node_struct*,unsignedint,char) call site /src/pugixml/src/pugixml.cpp:3446
0 0 None 0 4 pugi::impl::(anonymousnamespace)::xml_parser::parse(char*,unsignedlong,pugi::impl::(anonymousnamespace)::xml_document_struct*,pugi::xml_node_struct*,unsignedint) call site /src/pugixml/src/pugixml.cpp:3525
0 0 None 0 4 pugi::impl::(anonymousnamespace)::xml_parser::parse(char*,unsignedlong,pugi::impl::(anonymousnamespace)::xml_document_struct*,pugi::xml_node_struct*,unsignedint) call site /src/pugixml/src/pugixml.cpp:3550
0 0 None 0 0 pugi::impl::(anonymousnamespace)::xml_allocator::allocate_memory_oob(unsignedlong,pugi::impl::(anonymousnamespace)::xml_memory_page*&) call site /src/pugixml/src/pugixml.cpp:719
0 0 None 0 0 pugi::impl::(anonymousnamespace)::convert_buffer(char*&,unsignedlong&,pugi::xml_encoding,voidconst*,unsignedlong,bool) call site /src/pugixml/src/pugixml.cpp:2289
0 0 None 0 0 pugi::impl::(anonymousnamespace)::get_mutable_buffer(char*&,unsignedlong&,voidconst*,unsignedlong,bool) call site /src/pugixml/src/pugixml.cpp:2061
0 0 None 0 0 pugi::impl::(anonymousnamespace)::get_mutable_buffer(char*&,unsignedlong&,voidconst*,unsignedlong,bool) call site /src/pugixml/src/pugixml.cpp:2071

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site2] 00000
1 pugi::xml_document::xml_document() [function] [call site2] 00001
2 pugi::xml_node::xml_node() [function] [call site2] 00002
2 pugi::xml_document::_create() [function] [call site2] 00003
3 __assert_fail [call site2] 00004
3 pugi::impl::(anonymous namespace)::xml_memory_page::construct(void*) [function] [call site2] 00005
3 __assert_fail [call site2] 00006
3 pugi::impl::(anonymous namespace)::xml_document_struct::xml_document_struct(pugi::impl::(anonymous namespace)::xml_memory_page*) [function] [call site2] 00007
4 pugi::xml_node_struct::xml_node_struct(pugi::impl::(anonymous namespace)::xml_memory_page*, pugi::xml_node_type) [function] [call site2] 00008
3 __assert_fail [call site2] 00009
1 pugi::xml_document::load_buffer(void const*, unsigned long, unsigned int, pugi::xml_encoding) [function] [call site2] 00010
2 pugi::xml_document::reset() [function] [call site2] 00011
3 pugi::xml_document::_destroy() [function] [call site2] 00012
4 __assert_fail [call site2] 00013
4 __assert_fail [call site2] 00014
4 __assert_fail [call site2] 00015
4 pugi::impl::(anonymous namespace)::xml_allocator::deallocate_page(pugi::impl::(anonymous namespace)::xml_memory_page*) [function] [call site2] 00016
3 pugi::xml_document::_create() [function] [call site2] 00017
2 pugi::impl::(anonymous namespace)::load_buffer_impl(pugi::impl::(anonymous namespace)::xml_document_struct*, pugi::xml_node_struct*, void*, unsigned long, unsigned int, pugi::xml_encoding, bool, bool, char**) [function] [call site2] 00018
3 pugi::impl::(anonymous namespace)::make_parse_result(pugi::xml_parse_status, long) [function] [call site2] 00019
4 pugi::xml_parse_result::xml_parse_result() [function] [call site2] 00020
3 pugi::impl::(anonymous namespace)::get_buffer_encoding(pugi::xml_encoding, void const*, unsigned long) [function] [call site2] 00021
4 pugi::impl::(anonymous namespace)::get_wchar_encoding() [function] [call site2] 00022
5 pugi::impl::(anonymous namespace)::is_little_endian() [function] [call site2] 00023
4 pugi::impl::(anonymous namespace)::is_little_endian() [function] [call site2] 00024
4 pugi::impl::(anonymous namespace)::is_little_endian() [function] [call site2] 00025
4 pugi::impl::(anonymous namespace)::guess_buffer_encoding(unsigned char const*, unsigned long) [function] [call site2] 00026
5 pugi::impl::(anonymous namespace)::parse_declaration_encoding(unsigned char const*, unsigned long, unsigned char const*&, unsigned long&) [function] [call site2] 00027
3 pugi::impl::(anonymous namespace)::auto_deleter ::auto_deleter(void*, void (*)(void*)) [function] [call site2] 00028
3 pugi::impl::(anonymous namespace)::convert_buffer(char*&, unsigned long&, pugi::xml_encoding, void const*, unsigned long, bool) [function] [call site2] 00029
4 pugi::impl::(anonymous namespace)::get_mutable_buffer(char*&, unsigned long&, void const*, unsigned long, bool) [function] [call site2] 00030
5 __assert_fail [call site2] 00031
4 pugi::impl::(anonymous namespace)::is_little_endian() [function] [call site2] 00032
4 bool pugi::impl::(anonymous namespace)::convert_buffer_generic >(char*&, unsigned long&, void const*, unsigned long, pugi::impl::(anonymous namespace)::utf16_decoder ) [function] [call site2] 00033
5 pugi::impl::(anonymous namespace)::utf8_counter::value_type pugi::impl::(anonymous namespace)::utf16_decoder ::process (unsigned short const*, unsigned long, pugi::impl::(anonymous namespace)::utf8_counter::value_type, pugi::impl::(anonymous namespace)::utf8_counter) [function] [call site2] 00034
6 pugi::impl::(anonymous namespace)::utf8_counter::low(unsigned long, unsigned int) [function] [call site2] 00035
6 pugi::impl::(anonymous namespace)::utf8_counter::low(unsigned long, unsigned int) [function] [call site2] 00036
6 pugi::impl::(anonymous namespace)::utf8_counter::high(unsigned long, unsigned int) [function] [call site2] 00037
5 pugi::impl::(anonymous namespace)::utf8_writer::value_type pugi::impl::(anonymous namespace)::utf16_decoder ::process (unsigned short const*, unsigned long, pugi::impl::(anonymous namespace)::utf8_writer::value_type, pugi::impl::(anonymous namespace)::utf8_writer) [function] [call site2] 00038
5 __assert_fail [call site2] 00039
4 bool pugi::impl::(anonymous namespace)::convert_buffer_generic >(char*&, unsigned long&, void const*, unsigned long, pugi::impl::(anonymous namespace)::utf16_decoder ) [function] [call site2] 00040
4 pugi::impl::(anonymous namespace)::is_little_endian() [function] [call site2] 00041
4 bool pugi::impl::(anonymous namespace)::convert_buffer_generic >(char*&, unsigned long&, void const*, unsigned long, pugi::impl::(anonymous namespace)::utf32_decoder ) [function] [call site2] 00042
4 bool pugi::impl::(anonymous namespace)::convert_buffer_generic >(char*&, unsigned long&, void const*, unsigned long, pugi::impl::(anonymous namespace)::utf32_decoder ) [function] [call site2] 00043
4 pugi::impl::(anonymous namespace)::convert_buffer_latin1(char*&, unsigned long&, void const*, unsigned long, bool) [function] [call site2] 00044
5 pugi::impl::(anonymous namespace)::get_latin1_7bit_prefix_length(unsigned char const*, unsigned long) [function] [call site2] 00045
5 __assert_fail [call site2] 00046
5 pugi::impl::(anonymous namespace)::get_mutable_buffer(char*&, unsigned long&, void const*, unsigned long, bool) [function] [call site2] 00047
5 pugi::impl::(anonymous namespace)::utf8_counter::value_type pugi::impl::(anonymous namespace)::latin1_decoder::process (unsigned char const*, unsigned long, pugi::impl::(anonymous namespace)::utf8_counter::value_type, pugi::impl::(anonymous namespace)::utf8_counter) [function] [call site2] 00048
6 pugi::impl::(anonymous namespace)::utf8_counter::low(unsigned long, unsigned int) [function] [call site2] 00049
5 pugi::impl::(anonymous namespace)::utf8_writer::value_type pugi::impl::(anonymous namespace)::latin1_decoder::process (unsigned char const*, unsigned long, pugi::impl::(anonymous namespace)::utf8_writer::value_type, pugi::impl::(anonymous namespace)::utf8_writer) [function] [call site2] 00050
5 __assert_fail [call site2] 00051
4 __assert_fail [call site2] 00052
3 pugi::impl::(anonymous namespace)::auto_deleter ::~auto_deleter() [function] [call site2] 00053
4 __clang_call_terminate [call site2] 00054
5 __cxa_begin_catch [call site2] 00055
3 pugi::impl::(anonymous namespace)::auto_deleter ::release() [function] [call site2] 00056
3 pugi::impl::(anonymous namespace)::xml_parser::parse(char*, unsigned long, pugi::impl::(anonymous namespace)::xml_document_struct*, pugi::xml_node_struct*, unsigned int) [function] [call site2] 00057
4 pugi::impl::(anonymous namespace)::make_parse_result(pugi::xml_parse_status, long) [function] [call site2] 00058
4 pugi::impl::(anonymous namespace)::xml_parser::xml_parser(pugi::impl::(anonymous namespace)::xml_allocator*) [function] [call site2] 00059
4 pugi::impl::(anonymous namespace)::xml_parser::parse_skip_bom(char*) [function] [call site2] 00060
4 pugi::impl::(anonymous namespace)::xml_parser::parse_tree(char*, pugi::xml_node_struct*, unsigned int, char) [function] [call site2] 00061
5 pugi::impl::(anonymous namespace)::get_strconv_attribute(unsigned int) [function] [call site2] 00062
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_simple(char*, char) [function] [call site2] 00063
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00064
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00065
8 __assert_fail [call site2] 00066
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_simple(char*, char) [function] [call site2] 00067
7 pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&) [function] [call site2] 00068
8 pugi::impl::(anonymous namespace)::utf8_writer::any(unsigned char*, unsigned int) [function] [call site2] 00069
9 pugi::impl::(anonymous namespace)::utf8_writer::low(unsigned char*, unsigned int) [function] [call site2] 00070
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00071
9 __assert_fail [call site2] 00072
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00073
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00074
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00075
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00076
8 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00077
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_eol(char*, char) [function] [call site2] 00078
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00079
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00080
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00081
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_eol(char*, char) [function] [call site2] 00082
7 pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&) [function] [call site2] 00083
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wconv(char*, char) [function] [call site2] 00084
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00085
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00086
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00087
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wconv(char*, char) [function] [call site2] 00088
7 pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&) [function] [call site2] 00089
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wconv(char*, char) [function] [call site2] 00090
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wconv(char*, char) [function] [call site2] 00091
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00092
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00093
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00094
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00095
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00096
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00097
7 pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&) [function] [call site2] 00098
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00099
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00100
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00101
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00102
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00103
6 pugi::impl::(anonymous namespace)::strconv_attribute_impl ::parse_wnorm(char*, char) [function] [call site2] 00104
6 __assert_fail [call site2] 00105
5 pugi::impl::(anonymous namespace)::get_strconv_pcdata(unsigned int) [function] [call site2] 00106
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00107
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00108
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00109
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00110
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00111
7 pugi::impl::(anonymous namespace)::strconv_escape(char*, pugi::impl::(anonymous namespace)::gap&) [function] [call site2] 00112
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00113
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00114
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00115
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00116
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00117
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00118
6 pugi::impl::(anonymous namespace)::strconv_pcdata_impl ::parse(char*) [function] [call site2] 00119
6 __assert_fail [call site2] 00120
5 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00121
6 pugi::impl::(anonymous namespace)::xml_allocator::reserve() [function] [call site2] 00122
6 pugi::impl::(anonymous namespace)::allocate_node(pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00123
7 pugi::impl::(anonymous namespace)::xml_allocator::allocate_object(unsigned long, pugi::impl::(anonymous namespace)::xml_memory_page*&) [function] [call site2] 00124
8 pugi::impl::(anonymous namespace)::xml_allocator::allocate_memory(unsigned long, pugi::impl::(anonymous namespace)::xml_memory_page*&) [function] [call site2] 00125
9 pugi::impl::(anonymous namespace)::xml_allocator::allocate_memory_oob(unsigned long, pugi::impl::(anonymous namespace)::xml_memory_page*&) [function] [call site2] 00126
10 pugi::impl::(anonymous namespace)::xml_allocator::allocate_page(unsigned long) [function] [call site2] 00127
11 pugi::impl::(anonymous namespace)::xml_memory_page::construct(void*) [function] [call site2] 00128
11 __assert_fail [call site2] 00129
11 __assert_fail [call site2] 00130
10 __assert_fail [call site2] 00131
7 pugi::xml_node_struct::xml_node_struct(pugi::impl::(anonymous namespace)::xml_memory_page*, pugi::xml_node_type) [function] [call site2] 00132
6 pugi::impl::(anonymous namespace)::append_node(pugi::xml_node_struct*, pugi::xml_node_struct*) [function] [call site2] 00133
5 pugi::impl::(anonymous namespace)::append_new_attribute(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&) [function] [call site2] 00134
6 pugi::impl::(anonymous namespace)::xml_allocator::reserve() [function] [call site2] 00135
6 pugi::impl::(anonymous namespace)::allocate_attribute(pugi::impl::(anonymous namespace)::xml_allocator&) [function] [call site2] 00136
7 pugi::impl::(anonymous namespace)::xml_allocator::allocate_object(unsigned long, pugi::impl::(anonymous namespace)::xml_memory_page*&) [function] [call site2] 00137
7 pugi::xml_attribute_struct::xml_attribute_struct(pugi::impl::(anonymous namespace)::xml_memory_page*) [function] [call site2] 00138
6 pugi::impl::(anonymous namespace)::append_attribute(pugi::xml_attribute_struct*, pugi::xml_node_struct*) [function] [call site2] 00139
5 pugi::impl::(anonymous namespace)::xml_parser::parse_question(char*, pugi::xml_node_struct*&, unsigned int, char) [function] [call site2] 00140
6 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00141
6 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00142
5 __assert_fail [call site2] 00143
5 pugi::impl::(anonymous namespace)::xml_parser::parse_exclamation(char*, pugi::xml_node_struct*, unsigned int, char) [function] [call site2] 00144
6 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00145
6 pugi::impl::(anonymous namespace)::strconv_comment(char*, char) [function] [call site2] 00146
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00147
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00148
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00149
6 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00150
6 pugi::impl::(anonymous namespace)::strconv_cdata(char*, char) [function] [call site2] 00151
7 pugi::impl::(anonymous namespace)::gap::gap() [function] [call site2] 00152
7 pugi::impl::(anonymous namespace)::gap::push(char*&, unsigned long) [function] [call site2] 00153
7 pugi::impl::(anonymous namespace)::gap::flush(char*) [function] [call site2] 00154
6 pugi::impl::(anonymous namespace)::xml_parser::parse_doctype_group(char*, char) [function] [call site2] 00155
7 __assert_fail [call site2] 00156
7 pugi::impl::(anonymous namespace)::xml_parser::parse_doctype_ignore(char*) [function] [call site2] 00157
8 __assert_fail [call site2] 00158
7 pugi::impl::(anonymous namespace)::xml_parser::parse_doctype_primitive(char*) [function] [call site2] 00159
6 __assert_fail [call site2] 00160
6 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00161
5 __assert_fail [call site2] 00162
5 pugi::impl::(anonymous namespace)::append_new_node(pugi::xml_node_struct*, pugi::impl::(anonymous namespace)::xml_allocator&, pugi::xml_node_type) [function] [call site2] 00163
4 pugi::impl::(anonymous namespace)::make_parse_result(pugi::xml_parse_status, long) [function] [call site2] 00164
4 __assert_fail [call site2] 00165
4 pugi::xml_parse_result::operator bool() const [function] [call site2] 00166
4 pugi::impl::(anonymous namespace)::make_parse_result(pugi::xml_parse_status, long) [function] [call site2] 00167
4 pugi::impl::(anonymous namespace)::xml_parser::has_element_node_siblings(pugi::xml_node_struct*) [function] [call site2] 00168
4 pugi::impl::(anonymous namespace)::make_parse_result(pugi::xml_parse_status, long) [function] [call site2] 00169
1 pugi::xml_document::load_buffer(void const*, unsigned long, unsigned int, pugi::xml_encoding) [function] [call site2] 00170
1 pugi::xml_document::load_buffer(void const*, unsigned long, unsigned int, pugi::xml_encoding) [function] [call site2] 00171
1 pugi::xml_document::~xml_document() [function] [call site2] 00172
2 pugi::xml_document::_destroy() [function] [call site2] 00173
2 __clang_call_terminate [call site2] 00174