Fuzz introspector: speex_encode_fuzzer_fixed
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
10 10 3 :

['speex_notify', 'speex_realloc', 'speex_warning']

10 10 speex_bits_pack call site: 00021 /src/speex/libspeex/bits.c:233
0 0 None 16 335 nb_encode call site: 00000 /src/speex/libspeex/nb_celp.c:592
0 0 None 16 335 nb_encode call site: 00000 /src/speex/libspeex/nb_celp.c:598
0 0 None 16 232 nb_encode call site: 00000 /src/speex/libspeex/nb_celp.c:755
0 0 None 12 198 nb_encode call site: 00000 /src/speex/libspeex/nb_celp.c:908
0 0 None 10 10 vbr_analysis call site: 00000 /src/speex/libspeex/vbr.c:238
0 0 None 4 10 open_loop_nbest_pitch call site: 00000 /src/speex/libspeex/ltp.c:237
0 0 None 2 226 sb_encode call site: 00000 /src/speex/libspeex/sb_celp.c:647
0 0 None 2 226 sb_encode call site: 00000 /src/speex/libspeex/sb_celp.c:653
0 0 None 2 2 vbr_analysis call site: 00000 /src/speex/libspeex/vbr.c:247
0 0 None 0 163 sb_encode call site: 00000 /src/speex/libspeex/sb_celp.c:838
0 0 None 0 163 sb_encode call site: 00000 /src/speex/libspeex/sb_celp.c:840

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 speex_lib_get_mode [function] [call site] 00001
1 speex_encoder_init [function] [call site] 00002
1 speex_bits_init [function] [call site] 00003
2 speex_alloc [function] [call site] 00004
3 calloc [call site] 00005
2 speex_bits_reset [function] [call site] 00006
1 speex_encoder_ctl [function] [call site] 00007
1 speex_encoder_ctl [function] [call site] 00008
1 speex_encoder_ctl [function] [call site] 00009
1 speex_encoder_ctl [function] [call site] 00010
1 speex_encoder_ctl [function] [call site] 00011
1 speex_encoder_ctl [function] [call site] 00012
1 speex_encoder_ctl [function] [call site] 00013
1 speex_encoder_ctl [function] [call site] 00014
1 speex_encoder_ctl [function] [call site] 00015
1 speex_encoder_ctl [function] [call site] 00016
1 speex_encoder_ctl [function] [call site] 00017
1 speex_encoder_ctl [function] [call site] 00018
1 speex_encoder_ctl [function] [call site] 00019
1 speex_encode_stereo_int [function] [call site] 00020
2 speex_bits_pack [function] [call site] 00021
3 speex_notify [function] [call site] 00022
3 speex_realloc [function] [call site] 00023
4 realloc [call site] 00024
3 speex_warning [function] [call site] 00025
3 speex_warning [function] [call site] 00026
2 speex_bits_pack [function] [call site] 00027
2 speex_bits_pack [function] [call site] 00028
2 speex_bits_pack [function] [call site] 00029
2 spx_ilog2 [function] [call site] 00030
2 scal_quant [function] [call site] 00031
2 speex_bits_pack [function] [call site] 00032
2 spx_ilog2 [function] [call site] 00033
2 scal_quant [function] [call site] 00034
2 speex_bits_pack [function] [call site] 00035
1 speex_encode_int [function] [call site] 00036
1 speex_bits_insert_terminator [function] [call site] 00037
2 speex_bits_pack [function] [call site] 00038
2 speex_bits_pack [function] [call site] 00039
1 speex_bits_nbytes [function] [call site] 00040
1 speex_bits_write [function] [call site] 00041
2 speex_bits_insert_terminator [function] [call site] 00042
1 speex_bits_reset [function] [call site] 00043
1 speex_bits_destroy [function] [call site] 00044
2 speex_free [function] [call site] 00045
1 speex_encoder_destroy [function] [call site] 00046