Fuzz introspector: db-daemon_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
25 25 3 :

['perror', 'libvchan_recv', 'verify_hdr']

504 508 handle_vchan_data call site: 00026 /src/qubes-os/qubes-core-qubesdb/fuzz/../daemon/db-cmds.c:687
0 0 None 2 2 qubesdb_init call site: 00001 /src/qubes-os/qubes-core-qubesdb/fuzz/../daemon/db-core.c:20
0 0 None 2 2 qubesdb_init call site: 00001 /src/qubes-os/qubes-core-qubesdb/fuzz/../daemon/db-core.c:25
0 0 None 0 0 handle_vchan_data call site: 00035 /src/qubes-os/qubes-core-qubesdb/fuzz/../daemon/db-cmds.c:710

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 qubesdb_init [function] [call site] 00001
2 strdup [call site] 00002
1 write_client_buffered [function] [call site] 00003
2 __assert_fail [call site] 00004
2 fcntl [call site] 00005
2 perror [call site] 00006
2 buffer_datacount [function] [call site] 00007
2 buffer_data [function] [call site] 00008
2 write [call site] 00009
2 __errno_location [call site] 00010
2 buffer_append [function] [call site] 00011
3 perror [call site] 00012
3 buffer_secure_zero [function] [call site] 00013
2 buffer_substract [function] [call site] 00014
3 __assert_fail [call site] 00015
3 buffer_secure_zero [function] [call site] 00016
3 perror [call site] 00017
3 exit [call site] 00018
2 buffer_substract [function] [call site] 00019
2 write [call site] 00020
2 __errno_location [call site] 00021
2 buffer_append [function] [call site] 00022
2 perror [call site] 00023
2 fcntl [call site] 00024
2 perror [call site] 00025
1 handle_vchan_data [function] [call site] 00026
2 libvchan_data_ready [function] [call site] 00027
2 libvchan_recv [function] [call site] 00028
3 __errno_location [call site] 00029
2 perror [call site] 00030
2 verify_hdr [function] [call site] 00031
3 verify_path [function] [call site] 00032
4 strlen [call site] 00033
2 fprintf [call site] 00034
2 libvchan_data_ready [function] [call site] 00035
2 handle_write [function] [call site] 00036
3 read_vchan_or_client [function] [call site] 00037
4 libvchan_recv [function] [call site] 00038
4 perror [call site] 00039
4 libvchan_close [function] [call site] 00040
4 read [call site] 00041
4 __errno_location [call site] 00042
4 perror [call site] 00043
3 verify_data [function] [call site] 00044
3 fprintf [call site] 00045
3 discard_data_and_send_error [function] [call site] 00046
4 discard_data [function] [call site] 00047
5 read_vchan_or_client [function] [call site] 00048
4 write_vchan_or_client [function] [call site] 00049
5 buffer_datacount [function] [call site] 00050
5 buffer_data [function] [call site] 00051
5 write [call site] 00052
5 buffer_data [function] [call site] 00053
5 vchan_write_nonblock [function] [call site] 00054
6 libvchan_buffer_space [function] [call site] 00055
6 libvchan_write [function] [call site] 00056
6 __errno_location [call site] 00057
5 __errno_location [call site] 00058
5 buffer_append [function] [call site] 00059
5 perror [call site] 00060
5 buffer_substract [function] [call site] 00061
5 write [call site] 00062
5 vchan_write_nonblock [function] [call site] 00063
5 __errno_location [call site] 00064
5 buffer_append [function] [call site] 00065
5 perror [call site] 00066
3 qubesdb_write [function] [call site] 00067
4 buffer_secure_zero [function] [call site] 00068
4 strdup [call site] 00069
4 fputs [call site] 00070
4 _exit [call site] 00071
3 fprintf [call site] 00072
3 write_vchan_or_client [function] [call site] 00073
3 write_vchan_or_client [function] [call site] 00074
3 write_vchan_or_client [function] [call site] 00075
3 write_vchan_or_client [function] [call site] 00076
3 qubesdb_fire_watches [function] [call site] 00077
4 strncmp [call site] 00078
4 strncpy [call site] 00079
4 fprintf [call site] 00080
2 fprintf [call site] 00081
2 discard_data_and_send_error [function] [call site] 00082
2 handle_multiread [function] [call site] 00083
3 fprintf [call site] 00084
3 discard_data_and_send_error [function] [call site] 00085
3 strncpy [call site] 00086
3 strlen [call site] 00087
3 qubesdb_search [function] [call site] 00088
4 strcmp [call site] 00089
3 strncmp [call site] 00090
3 strncpy [call site] 00091
3 write_vchan_or_client [function] [call site] 00092
3 write_vchan_or_client [function] [call site] 00093
3 write_vchan_or_client [function] [call site] 00094
2 libvchan_buffer_space [function] [call site] 00095
2 fprintf [call site] 00096
2 handle_rm [function] [call site] 00097
3 fprintf [call site] 00098
3 discard_data_and_send_error [function] [call site] 00099
3 qubesdb_remove [function] [call site] 00100
4 strlen [call site] 00101
4 qubesdb_search [function] [call site] 00102
4 strncmp [call site] 00103
4 buffer_secure_zero [function] [call site] 00104
3 write_vchan_or_client [function] [call site] 00105
3 write_vchan_or_client [function] [call site] 00106
3 write_vchan_or_client [function] [call site] 00107
3 qubesdb_fire_watches [function] [call site] 00108
2 fprintf [call site] 00109
2 fprintf [call site] 00110
2 handle_vchan_multiread_resp [function] [call site] 00111
3 libvchan_recv [function] [call site] 00112
3 perror [call site] 00113
3 verify_data [function] [call site] 00114
3 fprintf [call site] 00115
3 qubesdb_write [function] [call site] 00116
3 fprintf [call site] 00117
3 qubesdb_fire_watches [function] [call site] 00118
2 fprintf [call site] 00119
2 fprintf [call site] 00120
1 qubesdb_destroy [function] [call site] 00121
2 buffer_secure_zero [function] [call site] 00122
2 buffer_secure_zero [function] [call site] 00123