Fuzz introspector: snappy_uncompress_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 0 None 136 594 voidsnappy::SnappyDecompressor::DecompressAllTags (snappy::SnappyArrayWriter*) call site: 00000 /src/snappy/snappy.cc:1456
0 0 None 30 30 snappy::SnappyDecompressor::RefillTag() call site: 00000 /src/snappy/snappy.cc:1555
0 0 None 4 321 snappy::Uncompress(charconst*,unsignedlong,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/snappy/snappy.cc:2041
0 0 None 0 0 snappy::Uncompress(charconst*,unsignedlong,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/snappy/snappy.cc:2046

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 __asan_stack_malloc_2 [call site] 00001
1 snappy::GetUncompressedLength(char const*, unsigned long, unsigned long*) [function] [call site] 00002
2 __asan_report_store4 [call site] 00003
2 snappy::Varint::Parse32WithLimit(char const*, char const*, unsigned int*) [function] [call site] 00004
3 __asan_report_load1 [call site] 00005
3 __asan_report_load1 [call site] 00006
3 __asan_report_load1 [call site] 00007
3 __asan_report_load1 [call site] 00008
3 __asan_report_load1 [call site] 00009
3 __asan_report_store4 [call site] 00010
2 __asan_report_load4 [call site] 00011
1 __asan_report_load8 [call site] 00012
1 snappy::Uncompress(char const*, unsigned long, std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00013
2 snappy::GetUncompressedLength(char const*, unsigned long, unsigned long*) [function] [call site] 00014
2 __asan_report_load8 [call site] 00015
2 __asan_report_load8 [call site] 00016
2 snappy::STLStringResizeUninitialized(std::__1::basic_string , std::__1::allocator >*, unsigned long) [function] [call site] 00017
2 snappy::string_as_array(std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00018
3 __asan_report_store8 [call site] 00019
2 snappy::RawUncompress(char const*, unsigned long, char*) [function] [call site] 00020
3 snappy::ByteArraySource::ByteArraySource(char const*, unsigned long) [function] [call site] 00021
4 snappy::Source::Source() [function] [call site] 00022
5 __asan_report_store8 [call site] 00023
4 __asan_report_store8 [call site] 00024
3 snappy::RawUncompress(snappy::Source*, char*) [function] [call site] 00025
4 snappy::SnappyArrayWriter::SnappyArrayWriter(char*) [function] [call site] 00026
5 __asan_report_store8 [call site] 00027
5 __asan_report_store8 [call site] 00028
5 __asan_report_store8 [call site] 00029
5 __asan_report_store8 [call site] 00030
4 bool snappy::InternalUncompress (snappy::Source*, snappy::SnappyArrayWriter*) [function] [call site] 00031
5 snappy::SnappyDecompressor::SnappyDecompressor(snappy::Source*) [function] [call site] 00032
6 __asan_report_store8 [call site] 00033
5 __asan_report_store4 [call site] 00034
5 snappy::SnappyDecompressor::ReadUncompressedLength(unsigned int*) [function] [call site] 00035
6 __asan_report_load8 [call site] 00036
6 __asan_report_store4 [call site] 00037
6 __asan_report_load8 [call site] 00038
6 __asan_report_load8 [call site] 00039
6 __asan_report_load1 [call site] 00040
6 __asan_report_load8 [call site] 00041
6 snappy::LeftShiftOverflows(unsigned char, unsigned int) [function] [call site] 00042
7 __asan_handle_no_return [call site] 00043
7 __asan_report_load1 [call site] 00044
6 __asan_report_load4 [call site] 00045
5 __asan_report_load8 [call site] 00046
5 __asan_report_load4 [call site] 00047
5 bool snappy::InternalUncompressAllTags (snappy::SnappyDecompressor*, snappy::SnappyArrayWriter*, unsigned int, unsigned int) [function] [call site] 00048
6 snappy::Report(char const*, unsigned long, unsigned long) [function] [call site] 00049
6 snappy::SnappyArrayWriter::SetExpectedLength(unsigned long) [function] [call site] 00050
7 __asan_report_load8 [call site] 00051
7 __asan_report_load8 [call site] 00052
6 void snappy::SnappyDecompressor::DecompressAllTags (snappy::SnappyArrayWriter*) [function] [call site] 00053
7 __asan_report_load8 [call site] 00054
7 snappy::SnappyDecompressor::ResetLimit(char const*) [function] [call site] 00055
8 __asan_report_load8 [call site] 00056
8 __asan_report_store8 [call site] 00057
7 snappy::SnappyArrayWriter::GetOutputPtr() [function] [call site] 00058
8 __asan_report_load8 [call site] 00059
7 __asan_report_store8 [call site] 00060
7 __asan_report_load8 [call site] 00061
7 snappy::SnappyDecompressor::RefillTag() [function] [call site] 00062
8 __asan_report_load8 [call site] 00063
8 __asan_report_load8 [call site] 00064
8 __asan_report_load8 [call site] 00065
8 __asan_report_load8 [call site] 00066
8 __asan_report_load8 [call site] 00067
8 __asan_report_store1 [call site] 00068
8 __asan_report_load1 [call site] 00069
8 __asan_report_load8 [call site] 00070
8 __asan_report_load8 [call site] 00071
8 __asan_report_load1 [call site] 00072
8 snappy::CalculateNeeded(unsigned char) [function] [call site] 00073
8 __asan_handle_no_return [call site] 00074
8 __asan_report_load8 [call site] 00075
8 __asan_memmove [call site] 00076
8 __asan_report_load8 [call site] 00077
8 __asan_report_store4 [call site] 00078
8 __asan_report_load8 [call site] 00079
8 __asan_report_load8 [call site] 00080
8 __asan_report_store4 [call site] 00081
8 __asan_memcpy [call site] 00082
8 __asan_report_load8 [call site] 00083
8 __asan_handle_no_return [call site] 00084
8 __asan_report_store8 [call site] 00085
8 __asan_report_store8 [call site] 00086
8 __asan_memmove [call site] 00087
8 __asan_report_load8 [call site] 00088
8 __asan_report_store4 [call site] 00089
8 __asan_report_store8 [call site] 00090
8 __asan_report_store8 [call site] 00091
8 __asan_report_store8 [call site] 00092
7 snappy::SnappyArrayWriter::GetBase(long*) [function] [call site] 00093
8 __asan_report_load8 [call site] 00094
8 __asan_report_load8 [call site] 00095
7 __asan_report_load8 [call site] 00096
7 __asan_report_load8 [call site] 00097
7 std::__1::pair snappy::DecompressBranchless (unsigned char const*, unsigned char const*, long, char*, long) [function] [call site] 00098
8 snappy::ClearDeferred(void const**, unsigned long*, unsigned char*) [function] [call site] 00099
9 __asan_report_store8 [call site] 00100
9 __asan_report_store8 [call site] 00101
8 __asan_report_load8 [call site] 00102
8 __asan_report_load8 [call site] 00103
8 __asan_report_load8 [call site] 00104
8 __asan_report_load8 [call site] 00105
8 __asan_report_load8 [call site] 00106
8 __asan_report_load8 [call site] 00107
8 __asan_report_load8 [call site] 00108
8 __asan_report_load8 [call site] 00109
8 snappy::LittleEndian::Load32(void const*) [function] [call site] 00110
9 __asan_memcpy [call site] 00111
9 __asan_report_load4 [call site] 00112
8 snappy::ExtractOffset(unsigned int, unsigned long) [function] [call site] 00113
9 __asan_report_store8 [call site] 00114
9 __asan_memcpy [call site] 00115
9 __asan_report_load2 [call site] 00116
8 __asan_report_store8 [call site] 00117
8 __asan_handle_no_return [call site] 00118
8 __asan_report_load8 [call site] 00119
8 __asan_report_load8 [call site] 00120
8 snappy::MemCopy64(char*, void const*, unsigned long) [function] [call site] 00121
9 __asan_handle_no_return [call site] 00122
9 __asan_report_load8 [call site] 00123
9 __asan_report_load8 [call site] 00124
9 __asan_report_load8 [call site] 00125
9 __asan_memmove [call site] 00126
8 __asan_report_load8 [call site] 00127
8 snappy::ClearDeferred(void const**, unsigned long*, unsigned char*) [function] [call site] 00128
8 __asan_report_load8 [call site] 00129
8 snappy::(anonymous namespace)::Copy64BytesWithPatternExtension(char*, unsigned long)::{lambda()#1}::operator()() const [function] [call site] 00130
9 __asan_report_store1 [call site] 00131
9 __asan_report_load_n [call site] 00132
8 __asan_report_load8 [call site] 00133
8 __asan_report_load8 [call site] 00134
8 __asan_report_load8 [call site] 00135
8 snappy::MemCopy64(char*, void const*, unsigned long) [function] [call site] 00136
8 __asan_report_load8 [call site] 00137
8 snappy::DeferMemCopy(void const**, unsigned long*, void const*, unsigned long) [function] [call site] 00138
9 __asan_report_store8 [call site] 00139
9 __asan_report_store8 [call site] 00140
8 __asan_report_load8 [call site] 00141
8 snappy::MemCopy64(char*, void const*, unsigned long) [function] [call site] 00142
8 __asan_report_load8 [call site] 00143
8 snappy::DeferMemCopy(void const**, unsigned long*, void const*, unsigned long) [function] [call site] 00144
8 __asan_report_load8 [call site] 00145
8 __asan_report_load8 [call site] 00146
8 __asan_report_load8 [call site] 00147
8 __asan_handle_no_return [call site] 00148
8 __asan_report_load8 [call site] 00149
8 __asan_report_load8 [call site] 00150
8 snappy::MemCopy64(char*, void const*, unsigned long) [function] [call site] 00151
8 __asan_report_load8 [call site] 00152
8 snappy::ClearDeferred(void const**, unsigned long*, unsigned char*) [function] [call site] 00153
8 __asan_report_load16 [call site] 00154
7 __asan_report_store8 [call site] 00155
7 __asan_report_load8 [call site] 00156
7 __asan_report_load8 [call site] 00157
7 __asan_report_load8 [call site] 00158
7 snappy::SnappyDecompressor::RefillTag() [function] [call site] 00159
7 __asan_report_load4 [call site] 00160
7 __asan_report_load8 [call site] 00161
7 snappy::SnappyArrayWriter::TryFastAppend(char const*, unsigned long, unsigned long, char**) [function] [call site] 00162
8 __asan_report_load8 [call site] 00163
8 __asan_report_load8 [call site] 00164
8 snappy::(anonymous namespace)::UnalignedCopy128(void const*, void*) [function] [call site] 00165
9 __asan_memcpy [call site] 00166
9 __asan_memcpy [call site] 00167
8 __asan_report_store8 [call site] 00168
7 __asan_handle_no_return [call site] 00169
7 __asan_report_load1 [call site] 00170
7 snappy::LittleEndian::Load32(void const*) [function] [call site] 00171
7 __asan_report_store4 [call site] 00172
7 snappy::ExtractLowBytes(unsigned int const&, int) [function] [call site] 00173
8 __asan_handle_no_return [call site] 00174
8 __asan_handle_no_return [call site] 00175
8 __asan_report_load4 [call site] 00176
7 __asan_report_load8 [call site] 00177
7 snappy::SnappyArrayWriter::Append(char const*, unsigned long, char**) [function] [call site] 00178
8 __asan_report_load8 [call site] 00179
8 __asan_report_load8 [call site] 00180
8 __asan_memcpy [call site] 00181
8 __asan_report_store8 [call site] 00182
7 __asan_report_load8 [call site] 00183
7 __asan_report_load8 [call site] 00184
7 __asan_report_load8 [call site] 00185
7 __asan_report_store4 [call site] 00186
7 __asan_report_store8 [call site] 00187
7 snappy::SnappyDecompressor::ResetLimit(char const*) [function] [call site] 00188
7 snappy::SnappyArrayWriter::Append(char const*, unsigned long, char**) [function] [call site] 00189
7 __asan_report_load8 [call site] 00190
7 snappy::SnappyDecompressor::RefillTag() [function] [call site] 00191
7 snappy::LittleEndian::Load32(void const*) [function] [call site] 00192
7 __asan_report_load8 [call site] 00193
7 snappy::(anonymous namespace)::IncrementalCopy(char const*, char*, char*, char*) [function] [call site] 00194
8 __asan_handle_no_return [call site] 00195
8 __asan_handle_no_return [call site] 00196
8 __asan_handle_no_return [call site] 00197
8 __asan_handle_no_return [call site] 00198
8 snappy::(anonymous namespace)::UnalignedCopy64(void const*, void*) [function] [call site] 00199
8 snappy::(anonymous namespace)::IncrementalCopySlow(char const*, char*, char*) [function] [call site] 00200
9 __asan_report_load1 [call site] 00201
8 __asan_handle_no_return [call site] 00202
8 void snappy::(anonymous namespace)::ConditionalUnalignedCopy128 (char const*, char*) [function] [call site] 00203
9 snappy::(anonymous namespace)::UnalignedCopy64(void const*, void*) [function] [call site] 00204
9 snappy::(anonymous namespace)::UnalignedCopy64(void const*, void*) [function] [call site] 00205
8 void snappy::(anonymous namespace)::ConditionalUnalignedCopy128 (char const*, char*) [function] [call site] 00206
8 void snappy::(anonymous namespace)::ConditionalUnalignedCopy128 (char const*, char*) [function] [call site] 00207
8 void snappy::(anonymous namespace)::ConditionalUnalignedCopy128 (char const*, char*) [function] [call site] 00208
8 void snappy::(anonymous namespace)::ConditionalUnalignedCopy128 (char const*, char*) [function] [call site] 00209
8 snappy::(anonymous namespace)::UnalignedCopy64(void const*, void*) [function] [call site] 00210
8 snappy::(anonymous namespace)::IncrementalCopySlow(char const*, char*, char*) [function] [call site] 00211
7 __asan_report_load2 [call site] 00212
7 snappy::LittleEndian::Load32(void const*) [function] [call site] 00213
7 __asan_report_store4 [call site] 00214
7 snappy::ExtractLowBytes(unsigned int const&, int) [function] [call site] 00215
7 __asan_handle_no_return [call site] 00216
7 __asan_report_load8 [call site] 00217
7 snappy::(anonymous namespace)::IncrementalCopy(char const*, char*, char*, char*) [function] [call site] 00218
7 __asan_report_load4 [call site] 00219
7 __asan_report_load8 [call site] 00220
7 __asan_report_load8 [call site] 00221
7 snappy::SnappyDecompressor::RefillTag() [function] [call site] 00222
7 __asan_report_load8 [call site] 00223
7 snappy::SnappyArrayWriter::SetOutputPtr(char*) [function] [call site] 00224
8 __asan_report_store8 [call site] 00225
6 snappy::SnappyArrayWriter::Flush() [function] [call site] 00226
6 snappy::SnappyDecompressor::eof() const [function] [call site] 00227
7 __asan_report_load1 [call site] 00228
5 snappy::SnappyDecompressor::~SnappyDecompressor() [function] [call site] 00229
6 __asan_report_load8 [call site] 00230
3 snappy::ByteArraySource::~ByteArraySource() [function] [call site] 00231
4 snappy::Source::~Source() [function] [call site] 00232