LLVMFuzzerTestOneInput:
   39|    170|{
   40|    170|    FuzzHelper f(data, size);
   41|    170|    f.run();
   42|    170|    return 0;
   43|    170|}
_ZN10FuzzHelperC2EPKhm:
   12|    170|        data(data),
   13|    170|        size(size)
   14|    170|    {
   15|    170|    }
_ZN10FuzzHelper3runEv:
   19|    170|    {
   20|    170|        qpdf::global::options::fuzz_mode(true);
   21|       |
   22|    170|        Pl_Discard discard;
   23|    170|        Pl_RunLength p("decode", &discard, Pl_RunLength::a_decode);
   24|    170|        try {
   25|    170|            p.write(data, size);
   26|    170|            p.finish();
   27|    170|        } catch (std::runtime_error const& e) {
   28|     67|            std::cerr << "runtime_error: " << e.what() << '\n';
   29|     67|        }
   30|    170|    }

_ZNK8Pipeline4nextEv:
  103|    206|    {
  104|    206|        return next_;
  105|    206|    }
_ZN8PipelineD2Ev:
   52|    340|    virtual ~Pipeline() = default;

_ZN4qpdf6global7options9fuzz_modeEb:
  132|    170|        {
  133|    170|            set_uint32(qpdf_p_fuzz_mode, value ? QPDF_TRUE : QPDF_FALSE);
  ------------------
  |  |  142|    170|#define QPDF_TRUE 1
  ------------------
                          set_uint32(qpdf_p_fuzz_mode, value ? QPDF_TRUE : QPDF_FALSE);
  ------------------
  |  |  143|    170|#define QPDF_FALSE 0
  ------------------
  |  Branch (133:42): [True: 170, False: 0]
  ------------------
  134|    170|        }
_ZN4qpdf6global10set_uint32E12qpdf_param_ej:
   53|    170|    {
   54|    170|        handle_result(qpdf_global_set_uint32(param, value));
   55|    170|    }
_ZN4qpdf6global13handle_resultE13qpdf_result_e:
   35|    170|    {
   36|    170|        if (result != qpdf_r_ok) {
  ------------------
  |  Branch (36:13): [True: 0, False: 170]
  ------------------
   37|      0|            QUtil::handle_result_code(result, "qpdf::global");
   38|      0|        }
   39|    170|    }

_ZN8PipelineC2EPKcPS_:
   11|    340|    identifier(identifier),
   12|    340|    next_(next)
   13|    340|{
   14|    340|}
_ZN8Pipeline11writeStringERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE:
   38|    103|{
   39|    103|    write(str.c_str(), str.length());
   40|    103|}
_ZN8Pipeline5writeEPKcm:
  114|    103|{
  115|    103|    write(reinterpret_cast<unsigned char const*>(data), len);
  116|    103|}

_ZN10Pl_DiscardC2Ev:
    9|    170|    Pipeline("discard", nullptr)
   10|    170|{
   11|    170|}
_ZN10Pl_DiscardD2Ev:
   14|    170|Pl_Discard::~Pl_Discard() = default;
_ZN10Pl_Discard5writeEPKhm:
   18|    103|{
   19|    103|}
_ZN10Pl_Discard6finishEv:
   23|    103|{
   24|    103|}

_ZN12Pl_RunLengthC2EPKcP8PipelineNS_8action_eE:
   32|    170|    Pipeline(identifier, next),
   33|    170|    m(std::make_unique<Members>(action))
   34|    170|{
   35|    170|    util::assertion(next, "Attempt to create Pl_RunLength with nullptr as next");
   36|    170|}
_ZN12Pl_RunLengthD2Ev:
   44|    170|Pl_RunLength::~Pl_RunLength() = default;
_ZN12Pl_RunLength5writeEPKhm:
   48|    170|{
   49|    170|    if (m->action == a_encode) {
  ------------------
  |  Branch (49:9): [True: 0, False: 170]
  ------------------
   50|      0|        encode(data, len);
   51|    170|    } else {
   52|    170|        decode(data, len);
   53|    170|    }
   54|    170|}
_ZN12Pl_RunLength6decodeEPKhm:
   90|    170|{
   91|    170|    util::no_ci_rt_error_if(
   92|    170|        memory_limit && (len + m->out.size()) > memory_limit, "Pl_RunLength memory limit exceeded");
  ------------------
  |  Branch (92:9): [True: 170, False: 0]
  |  Branch (92:25): [True: 23, False: 147]
  ------------------
   93|    170|    m->out.reserve(len);
   94|  5.34M|    for (size_t i = 0; i < len; ++i) {
  ------------------
  |  Branch (94:24): [True: 5.34M, False: 170]
  ------------------
   95|  5.34M|        unsigned char const& ch = data[i];
   96|  5.34M|        switch (m->state) {
  ------------------
  |  Branch (96:17): [True: 5.34M, False: 0]
  ------------------
   97|  2.42M|        case st_top:
  ------------------
  |  Branch (97:9): [True: 2.42M, False: 2.91M]
  ------------------
   98|  2.42M|            if (ch < 128) {
  ------------------
  |  Branch (98:17): [True: 33.9k, False: 2.39M]
  ------------------
   99|       |                // length represents remaining number of bytes to copy
  100|  33.9k|                m->length = 1U + ch;
  101|  33.9k|                m->state = st_copying;
  102|  2.39M|            } else if (ch > 128) {
  ------------------
  |  Branch (102:24): [True: 2.39M, False: 599]
  ------------------
  103|       |                // length represents number of copies of next byte
  104|  2.39M|                m->length = 257U - ch;
  105|  2.39M|                m->state = st_run;
  106|  2.39M|            } else // ch == 128
  107|    599|            {
  108|       |                // EOD; stay in this state
  109|    599|            }
  110|  2.42M|            break;
  111|       |
  112|   522k|        case st_copying:
  ------------------
  |  Branch (112:9): [True: 522k, False: 4.81M]
  ------------------
  113|   522k|            m->out.append(1, static_cast<char>(ch));
  114|   522k|            if (--m->length == 0) {
  ------------------
  |  Branch (114:17): [True: 33.9k, False: 488k]
  ------------------
  115|  33.9k|                m->state = st_top;
  116|  33.9k|            }
  117|   522k|            break;
  118|       |
  119|  2.39M|        case st_run:
  ------------------
  |  Branch (119:9): [True: 2.39M, False: 2.94M]
  ------------------
  120|  2.39M|            m->out.append(m->length, static_cast<char>(ch));
  121|  2.39M|            m->state = st_top;
  122|  2.39M|            break;
  123|  5.34M|        }
  124|  5.34M|    }
  125|    170|}
_ZN12Pl_RunLength6finishEv:
  159|    147|{
  160|       |    // When decoding, we might have read a length byte not followed by data, which means the stream
  161|       |    // was terminated early, but we will just ignore this case since this is the only sensible thing
  162|       |    // to do.
  163|    147|    if (m->action == a_encode) {
  ------------------
  |  Branch (163:9): [True: 0, False: 147]
  ------------------
  164|      0|        flush_encode();
  165|      0|        unsigned char ch = 128;
  166|      0|        next()->write(&ch, 1);
  167|    147|    } else {
  168|    147|        if (memory_limit && (m->out.size()) > memory_limit) {
  ------------------
  |  Branch (168:13): [True: 147, False: 0]
  |  Branch (168:29): [True: 44, False: 103]
  ------------------
  169|     44|            throw std::runtime_error("Pl_RunLength memory limit exceeded");
  170|     44|        }
  171|    103|        next()->writeString(m->out);
  172|    103|    }
  173|    103|    next()->finish();
  174|    103|}
_ZN12Pl_RunLength7MembersC2ENS_8action_eE:
   18|    170|        action(action)
   19|    170|    {
   20|    170|    }
_ZN12Pl_RunLength7MembersD2Ev:
   22|    170|    ~Members() = default;

_ZN4qpdf6global7Options9fuzz_modeEb:
   13|    170|{
   14|    170|    if (value) {
  ------------------
  |  Branch (14:9): [True: 170, False: 0]
  ------------------
   15|    170|        o.fuzz_mode_ = true;
   16|       |        // Limit the memory used to decompress JPEG files during fuzzing. Excessive memory use
   17|       |        // during fuzzing is due to corrupt JPEG data which sometimes cannot be detected before
   18|       |        // jpeg_start_decompress is called. During normal use of qpdf very large JPEGs can
   19|       |        // occasionally occur legitimately and therefore must be allowed during normal operations.
   20|    170|        Limits::dct_max_memory(10'000'000);
   21|    170|        Limits::dct_max_progressive_scans(50);
   22|       |        // Do not decompress corrupt data. This may cause extended runtime within jpeglib without
   23|       |        // exercising additional code paths in qpdf.
   24|    170|        dct_throw_on_corrupt_data(true);
   25|    170|        Limits::png_max_memory(1'000'000);
   26|    170|        Limits::flate_max_memory(200'000);
   27|    170|        Limits::run_length_max_memory(1'000'000);
   28|    170|        Limits::tiff_max_memory(1'000'000);
   29|       |        // Set a reasonable default maximum warnings per document for fuzzing to avoid time-outs due
   30|       |        // to extensive recovery efforts.
   31|    170|        Limits::doc_max_warnings(200);
   32|    170|    }
   33|    170|}
qpdf_global_set_uint32:
  129|    170|{
  130|    170|    switch (param) {
  131|      0|    case qpdf_p_inspection_mode:
  ------------------
  |  Branch (131:5): [True: 0, False: 170]
  ------------------
  132|      0|        Options::inspection_mode(value);
  133|      0|        return qpdf_r_ok;
  134|    170|    case qpdf_p_fuzz_mode:
  ------------------
  |  Branch (134:5): [True: 170, False: 0]
  ------------------
  135|    170|        Options::fuzz_mode(value);
  136|    170|        return qpdf_r_ok;
  137|      0|    case qpdf_p_default_limits:
  ------------------
  |  Branch (137:5): [True: 0, False: 170]
  ------------------
  138|      0|        Options::default_limits(value);
  139|      0|        return qpdf_r_ok;
  140|      0|    case qpdf_p_dct_throw_on_corrupt_data:
  ------------------
  |  Branch (140:5): [True: 0, False: 170]
  ------------------
  141|      0|        Options::dct_throw_on_corrupt_data(value);
  142|      0|        return qpdf_r_ok;
  143|      0|    case qpdf_p_doc_max_warnings:
  ------------------
  |  Branch (143:5): [True: 0, False: 170]
  ------------------
  144|      0|        Limits::doc_max_warnings(value);
  145|      0|        return qpdf_r_ok;
  146|      0|    case qpdf_p_parser_max_nesting:
  ------------------
  |  Branch (146:5): [True: 0, False: 170]
  ------------------
  147|      0|        Limits::parser_max_nesting(value);
  148|      0|        return qpdf_r_ok;
  149|      0|    case qpdf_p_parser_max_errors:
  ------------------
  |  Branch (149:5): [True: 0, False: 170]
  ------------------
  150|      0|        Limits::parser_max_errors(value);
  151|      0|        return qpdf_r_ok;
  152|      0|    case qpdf_p_parser_max_container_size:
  ------------------
  |  Branch (152:5): [True: 0, False: 170]
  ------------------
  153|      0|        Limits::parser_max_container_size(false, value);
  154|      0|        return qpdf_r_ok;
  155|      0|    case qpdf_p_parser_max_container_size_damaged:
  ------------------
  |  Branch (155:5): [True: 0, False: 170]
  ------------------
  156|      0|        Limits::parser_max_container_size(true, value);
  157|      0|        return qpdf_r_ok;
  158|      0|    case qpdf_p_max_stream_filters:
  ------------------
  |  Branch (158:5): [True: 0, False: 170]
  ------------------
  159|      0|        Limits::max_stream_filters(value);
  160|      0|        return qpdf_r_ok;
  161|      0|    case qpdf_p_dct_max_memory:
  ------------------
  |  Branch (161:5): [True: 0, False: 170]
  ------------------
  162|      0|        Limits::dct_max_memory(util::fits<long>(value) ? static_cast<long>(value) : 0);
  ------------------
  |  Branch (162:32): [True: 0, False: 0]
  ------------------
  163|      0|        return qpdf_r_ok;
  164|      0|    case qpdf_p_dct_max_progressive_scans:
  ------------------
  |  Branch (164:5): [True: 0, False: 170]
  ------------------
  165|      0|        Limits::dct_max_progressive_scans(util::fits<int>(value) ? static_cast<int>(value) : 0);
  ------------------
  |  Branch (165:43): [True: 0, False: 0]
  ------------------
  166|      0|        return qpdf_r_ok;
  167|      0|    case qpdf_p_flate_max_memory:
  ------------------
  |  Branch (167:5): [True: 0, False: 170]
  ------------------
  168|      0|        Limits::flate_max_memory(value);
  169|      0|        return qpdf_r_ok;
  170|      0|    case qpdf_p_png_max_memory:
  ------------------
  |  Branch (170:5): [True: 0, False: 170]
  ------------------
  171|      0|        Limits::png_max_memory(value);
  172|      0|        return qpdf_r_ok;
  173|      0|    case qpdf_p_run_length_max_memory:
  ------------------
  |  Branch (173:5): [True: 0, False: 170]
  ------------------
  174|      0|        Limits::run_length_max_memory(value);
  175|      0|        return qpdf_r_ok;
  176|      0|    case qpdf_p_tiff_max_memory:
  ------------------
  |  Branch (176:5): [True: 0, False: 170]
  ------------------
  177|      0|        Limits::tiff_max_memory(value);
  178|      0|        return qpdf_r_ok;
  179|      0|    default:
  ------------------
  |  Branch (179:5): [True: 0, False: 170]
  ------------------
  180|      0|        return qpdf_r_bad_parameter;
  181|    170|    }
  182|    170|}

_ZN4qpdf4util4fitsIjTkNSt3__18integralEyQsr3stdE8integralIT_EEEbT0_:
   63|    680|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|       |                          std::numeric_limits<T>::min())) {
   67|       |            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
   68|       |                return false;
   69|       |            }
   70|       |        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|    680|                          std::numeric_limits<T>::max())) {
   74|    680|            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
  ------------------
  |  Branch (74:17): [True: 0, False: 680]
  ------------------
   75|      0|                return false;
   76|      0|            }
   77|    680|        }
   78|    680|        return true;
   79|    680|    }
_ZN4qpdf4util9assertionIRA52_KcEEvbOT_:
   27|    170|    {
   28|    170|        if (!cond) {
  ------------------
  |  Branch (28:13): [True: 0, False: 170]
  ------------------
   29|      0|            throw std::logic_error(std::forward<T>(msg));
   30|      0|        }
   31|    170|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA35_KcEEvbOT_:
   48|    170|    {
   49|    170|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 23, False: 147]
  ------------------
   50|     23|            throw std::runtime_error(std::forward<T>(msg));
   51|     23|        }
   52|    170|    }
_ZN4qpdf4util4fitsIjTkNSt3__18integralElQsr3stdE8integralIT_EEEbT0_:
   63|    170|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|    170|                          std::numeric_limits<T>::min())) {
   67|    170|            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
  ------------------
  |  Branch (67:17): [True: 0, False: 170]
  ------------------
   68|      0|                return false;
   69|      0|            }
   70|    170|        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|    170|                          std::numeric_limits<T>::max())) {
   74|    170|            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
  ------------------
  |  Branch (74:17): [True: 0, False: 170]
  ------------------
   75|      0|                return false;
   76|      0|            }
   77|    170|        }
   78|    170|        return true;
   79|    170|    }
_ZN4qpdf4util4fitsIjTkNSt3__18integralEiQsr3stdE8integralIT_EEEbT0_:
   63|    170|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|    170|                          std::numeric_limits<T>::min())) {
   67|    170|            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
  ------------------
  |  Branch (67:17): [True: 0, False: 170]
  ------------------
   68|      0|                return false;
   69|      0|            }
   70|    170|        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|       |                          std::numeric_limits<T>::max())) {
   74|       |            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
   75|       |                return false;
   76|       |            }
   77|       |        }
   78|    170|        return true;
   79|    170|    }

_ZN4qpdf6global6Limits21run_length_max_memoryEv:
  128|      2|        {
  129|      2|            return l.run_length_max_memory_;
  130|      2|        }
_ZN4qpdf6global6Limits21run_length_max_memoryEy:
  134|    170|        {
  135|    170|            l.run_length_max_memory_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (135:40): [True: 170, False: 0]
  ------------------
  136|    170|        }
_ZN4qpdf6global6Limits16doc_max_warningsEj:
   28|    170|        {
   29|    170|            l.doc_max_warnings_ = value;
   30|    170|        }
_ZN4qpdf6global6Limits14dct_max_memoryEl:
   86|    170|        {
   87|    170|            l.dct_max_memory_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (87:33): [True: 170, False: 0]
  ------------------
   88|    170|        }
_ZN4qpdf6global6Limits25dct_max_progressive_scansEi:
   98|    170|        {
   99|    170|            l.dct_max_progressive_scans_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (99:44): [True: 170, False: 0]
  ------------------
  100|    170|        }
_ZN4qpdf6global6Limits16flate_max_memoryEy:
  110|    170|        {
  111|    170|            l.flate_max_memory_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (111:35): [True: 170, False: 0]
  ------------------
  112|    170|        }
_ZN4qpdf6global6Limits14png_max_memoryEy:
  122|    170|        {
  123|    170|            l.png_max_memory_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (123:33): [True: 170, False: 0]
  ------------------
  124|    170|        }
_ZN4qpdf6global6Limits15tiff_max_memoryEy:
  146|    170|        {
  147|    170|            l.tiff_max_memory_ = util::fits<uint32_t>(value) ? value : 0;
  ------------------
  |  Branch (147:34): [True: 170, False: 0]
  ------------------
  148|    170|        }
_ZN4qpdf6global7Options25dct_throw_on_corrupt_dataEb:
  240|    170|        {
  241|    170|            o.dct_throw_on_corrupt_data_ = value;
  242|    170|        }