Fuzz introspector: qrexec_remote_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
4 131 7 :

['do_replace_chars', 'read_vchan_all', 'fuzz_libvchan_recv', 'fuzz_libvchan_data_ready', 'write_stdin', 'write_all', '__errno_location']

4 131 handle_remote_data call site: 00048 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:123
0 0 None 24 39 flush_client_data call site: 00011 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:43
0 0 None 23 23 write_stdin call site: 00043 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:80
0 0 None 21 21 write_stdin call site: 00036 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:70
0 0 None 4 131 handle_remote_data call site: 00010 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:57
0 0 None 4 131 handle_remote_data call site: 00032 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:84
0 0 None 4 131 handle_remote_data call site: 00032 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:91
0 0 None 4 131 handle_remote_data call site: 00046 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:109
0 0 None 4 131 handle_remote_data call site: 00048 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:117
0 0 None 4 4 write_stdin call site: 00042 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:76
0 0 None 2 15 write_all call site: 00050 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/ioall.c:62
0 0 None 0 6 fuzz_libvchan_read call site: 00028 /src/qubes-os/qubes-core-qrexec/fuzz/fuzz.c:62

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_file_create [function] [call site] 00001
2 panic [function] [call site] 00002
3 fprintf [call site] 00003
3 abort [call site] 00004
1 fuzz_file_create [function] [call site] 00005
1 fuzz_file_create [function] [call site] 00006
1 buffer_init [function] [call site] 00007
1 handle_remote_data [function] [call site] 00008
2 max_data_chunk_size [function] [call site] 00009
2 flush_client_data [function] [call site] 00010
3 buffer_len [function] [call site] 00011
3 buffer_data [function] [call site] 00012
3 fuzz_write [function] [call site] 00013
4 panic [function] [call site] 00014
3 __errno_location [call site] 00015
3 buffer_remove [function] [call site] 00016
4 fuzz_exit [function] [call site] 00017
5 abort [call site] 00018
4 limited_malloc [function] [call site] 00019
5 fuzz_exit [function] [call site] 00020
5 fuzz_exit [function] [call site] 00021
4 buffer_free [function] [call site] 00022
5 limited_free [function] [call site] 00023
6 abort [call site] 00024
5 buffer_init [function] [call site] 00025
2 fuzz_libvchan_data_ready [function] [call site] 00026
2 fuzz_libvchan_recv [function] [call site] 00027
3 fuzz_libvchan_read [function] [call site] 00028
4 file_input_eof [function] [call site] 00029
4 file_read [function] [call site] 00030
5 __assert_fail [call site] 00031
2 read_vchan_all [function] [call site] 00032
3 fuzz_libvchan_read [function] [call site] 00033
2 do_replace_chars [function] [call site] 00034
2 write_stdin [function] [call site] 00035
3 buffer_len [function] [call site] 00036
3 buffer_append [function] [call site] 00037
4 fuzz_exit [function] [call site] 00038
4 fuzz_exit [function] [call site] 00039
4 limited_malloc [function] [call site] 00040
4 buffer_free [function] [call site] 00041
3 fuzz_write [function] [call site] 00042
3 fuzz_exit [function] [call site] 00043
3 __errno_location [call site] 00044
3 buffer_append [function] [call site] 00045
2 __errno_location [call site] 00046
2 do_replace_chars [function] [call site] 00047
2 write_all [function] [call site] 00048
3 fuzz_write [function] [call site] 00049
3 __errno_location [call site] 00050
1 fuzz_file_destroy [function] [call site] 00051
1 fuzz_file_destroy [function] [call site] 00052
1 fuzz_file_destroy [function] [call site] 00053