Fuzz introspector: qrexec_remote_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
4 133 7 :

['write_all', '__errno_location', 'fuzz_libvchan_data_ready', 'read_vchan_all', 'do_replace_chars', 'fuzz_libvchan_recv', 'write_stdin']

4 133 handle_remote_data_v2 call site: 00050 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:124
2 2 1 :

['abort']

2 2 handle_remote_data_v2 call site: 00009 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:49
0 0 None 25 40 flush_client_data call site: 00012 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:43
0 0 None 10 10 write_stdin call site: 00045 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:80
0 0 None 8 8 write_stdin call site: 00037 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:70
0 0 None 4 133 handle_remote_data_v2 call site: 00033 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:85
0 0 None 4 133 handle_remote_data_v2 call site: 00033 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:92
0 0 None 4 133 handle_remote_data_v2 call site: 00048 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:110
0 0 None 4 133 handle_remote_data_v2 call site: 00050 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/remote.c:118
0 0 None 2 15 write_all call site: 00052 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/ioall.c:62
0 0 None 2 2 write_stdin call site: 00044 /src/qubes-os/qubes-core-qrexec/fuzz/../libqrexec/write-stdin.c:76
0 0 None 0 6 fuzz_libvchan_read call site: 00029 /src/qubes-os/qubes-core-qrexec/fuzz/fuzz.c:62

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 max_data_chunk_size [function] [call site] 00001
1 abort [call site] 00002
1 fuzz_file_create [function] [call site] 00003
2 panic [function] [call site] 00004
3 fprintf [call site] 00005
3 abort [call site] 00006
1 fuzz_file_create [function] [call site] 00007
1 fuzz_file_create [function] [call site] 00008
1 handle_remote_data_v2 [function] [call site] 00009
2 abort [call site] 00010
2 flush_client_data [function] [call site] 00011
3 buffer_len [function] [call site] 00012
3 buffer_data [function] [call site] 00013
3 fuzz_write [function] [call site] 00014
4 panic [function] [call site] 00015
3 __errno_location [call site] 00016
3 buffer_remove [function] [call site] 00017
4 fuzz_exit [function] [call site] 00018
5 abort [call site] 00019
4 limited_malloc [function] [call site] 00020
5 fuzz_exit [function] [call site] 00021
5 fuzz_exit [function] [call site] 00022
4 buffer_free [function] [call site] 00023
5 limited_free [function] [call site] 00024
6 abort [call site] 00025
5 buffer_init [function] [call site] 00026
2 fuzz_libvchan_data_ready [function] [call site] 00027
2 fuzz_libvchan_recv [function] [call site] 00028
3 fuzz_libvchan_read [function] [call site] 00029
4 file_input_eof [function] [call site] 00030
4 file_read [function] [call site] 00031
5 __assert_fail [call site] 00032
2 read_vchan_all [function] [call site] 00033
3 fuzz_libvchan_read [function] [call site] 00034
2 do_replace_chars [function] [call site] 00035
2 write_stdin [function] [call site] 00036
3 buffer_len [function] [call site] 00037
3 buffer_append [function] [call site] 00038
4 __assert_fail [call site] 00039
4 fuzz_exit [function] [call site] 00040
4 fuzz_exit [function] [call site] 00041
4 limited_malloc [function] [call site] 00042
4 buffer_free [function] [call site] 00043
3 fuzz_write [function] [call site] 00044
3 abort [call site] 00045
3 __errno_location [call site] 00046
3 buffer_append [function] [call site] 00047
2 __errno_location [call site] 00048
2 do_replace_chars [function] [call site] 00049
2 write_all [function] [call site] 00050
3 fuzz_write [function] [call site] 00051
3 __errno_location [call site] 00052
1 fuzz_file_destroy [function] [call site] 00053
1 fuzz_file_destroy [function] [call site] 00054
1 fuzz_file_destroy [function] [call site] 00055