Fuzz introspector: fuzz_ParseFromString
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
12 42 3 :

['tinyobj::fixIndex(int, int, int*, bool, tinyobj::warning_context const&)', 'strcspn', 'atoi']

12 42 tinyobj::parseTriple(charconst**,int,int,int,tinyobj::vertex_index_t*,tinyobj::warning_contextconst&) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:1174
6 14 4 :

['tinyobj::parseInt(char const**)', 'strcspn', 'strspn', 'atoi']

6 14 tinyobj::parseTagTriple(charconst**) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:1141
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2075
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2079
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2117
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2128
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2139
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2151
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2181
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2273
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2280
0 0 None 288 2423 tinyobj::LoadMtl(std::__1::map ,std::__1::allocator >,int,std::__1::less ,std::__1::allocator >>,std::__1::allocator ,std::__1::allocator >const,int>>>*,std::__1::vector >*,std::__1::basic_istream >*,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/tinyobjloader/tiny_obj_loader.h:2287

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 tinyobj::ObjReaderConfig::ObjReaderConfig() [function] [call site] 00001
1 tinyobj::ObjReader::ObjReader() [function] [call site] 00002
2 tinyobj::attrib_t::attrib_t() [function] [call site] 00003
1 tinyobj::ObjReader::ParseFromString(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, tinyobj::ObjReaderConfig const&) [function] [call site] 00004
2 tinyobj::MaterialStreamReader::MaterialStreamReader(std::__1::basic_istream >&) [function] [call site] 00005
3 tinyobj::MaterialReader::MaterialReader() [function] [call site] 00006
2 tinyobj::LoadObj(tinyobj::attrib_t*, std::__1::vector >*, std::__1::vector >*, std::__1::basic_string , std::__1::allocator >*, std::__1::basic_string , std::__1::allocator >*, std::__1::basic_istream >*, tinyobj::MaterialReader*, bool, bool) [function] [call site] 00007
3 tinyobj::PrimGroup::PrimGroup() [function] [call site] 00008
3 tinyobj::shape_t::shape_t() [function] [call site] 00009
4 tinyobj::mesh_t::mesh_t() [function] [call site] 00010
3 tinyobj::safeGetline(std::__1::basic_istream >&, std::__1::basic_string , std::__1::allocator >&) [function] [call site] 00011
3 strspn [call site] 00012
3 __assert_fail [call site] 00013
3 tinyobj::parseVertexWithColor(float*, float*, float*, float*, float*, float*, char const**, double, double, double) [function] [call site] 00014
4 tinyobj::parseReal(char const**, double) [function] [call site] 00015
5 strspn [call site] 00016
5 strcspn [call site] 00017
5 tinyobj::tryParseDouble(char const*, char const*, double*) [function] [call site] 00018
6 _Z3powIdiENSt3__19enable_ifIXaasr3std13is_arithmeticIT_EE5valuesr3std13is_arithmeticIT0_EE5valueENS0_9__promoteIS2_S3_vEEE4type4typeES2_S3_ [function] [call site] 00019
7 pow [call site] 00020
6 _Z3powIdiENSt3__19enable_ifIXaasr3std13is_arithmeticIT_EE5valuesr3std13is_arithmeticIT0_EE5valueENS0_9__promoteIS2_S3_vEEE4type4typeES2_S3_ [function] [call site] 00021
6 ldexp [call site] 00022
4 tinyobj::parseReal(char const**, double) [function] [call site] 00023
4 tinyobj::parseReal(char const**, double) [function] [call site] 00024
4 tinyobj::parseReal(char const**, float*) [function] [call site] 00025
5 strspn [call site] 00026
5 strcspn [call site] 00027
5 tinyobj::tryParseDouble(char const*, char const*, double*) [function] [call site] 00028
3 tinyobj::parseReal3(float*, float*, float*, char const**, double, double, double) [function] [call site] 00029
4 tinyobj::parseReal(char const**, double) [function] [call site] 00030
4 tinyobj::parseReal(char const**, double) [function] [call site] 00031
4 tinyobj::parseReal(char const**, double) [function] [call site] 00032
3 tinyobj::parseReal2(float*, float*, char const**, double, double) [function] [call site] 00033
4 tinyobj::parseReal(char const**, double) [function] [call site] 00034
4 tinyobj::parseReal(char const**, double) [function] [call site] 00035
3 tinyobj::parseInt(char const**) [function] [call site] 00036
4 strspn [call site] 00037
4 atoi [call site] 00038
4 strcspn [call site] 00039
3 tinyobj::skin_weight_t::skin_weight_t() [function] [call site] 00040
3 tinyobj::parseReal2(float*, float*, char const**, double, double) [function] [call site] 00041
3 strspn [call site] 00042
3 tinyobj::skin_weight_t::~skin_weight_t() [function] [call site] 00043
3 tinyobj::__line_t::__line_t() [function] [call site] 00044
3 tinyobj::vertex_index_t::vertex_index_t() [function] [call site] 00045
3 tinyobj::parseTriple(char const**, int, int, int, tinyobj::vertex_index_t*, tinyobj::warning_context const&) [function] [call site] 00046
4 tinyobj::vertex_index_t::vertex_index_t(int) [function] [call site] 00047
4 atoi [call site] 00048
4 tinyobj::fixIndex(int, int, int*, bool, tinyobj::warning_context const&) [function] [call site] 00049
5 std::__1::basic_string , std::__1::allocator > tinyobj::toString (unsigned long const&) [function] [call site] 00050
4 strcspn [call site] 00051
4 atoi [call site] 00052
4 tinyobj::fixIndex(int, int, int*, bool, tinyobj::warning_context const&) [function] [call site] 00053
4 strcspn [call site] 00054
4 atoi [call site] 00055
4 tinyobj::fixIndex(int, int, int*, bool, tinyobj::warning_context const&) [function] [call site] 00056
4 strcspn [call site] 00057
4 atoi [call site] 00058
4 tinyobj::fixIndex(int, int, int*, bool, tinyobj::warning_context const&) [function] [call site] 00059
4 strcspn [call site] 00060
3 std::__1::basic_string , std::__1::allocator > tinyobj::toString (unsigned long const&) [function] [call site] 00061
3 strspn [call site] 00062
3 tinyobj::__line_t::~__line_t() [function] [call site] 00063
3 tinyobj::__points_t::__points_t() [function] [call site] 00064
3 tinyobj::vertex_index_t::vertex_index_t() [function] [call site] 00065
3 tinyobj::parseTriple(char const**, int, int, int, tinyobj::vertex_index_t*, tinyobj::warning_context const&) [function] [call site] 00066
3 std::__1::basic_string , std::__1::allocator > tinyobj::toString (unsigned long const&) [function] [call site] 00067
3 strspn [call site] 00068
3 tinyobj::__points_t::~__points_t() [function] [call site] 00069
3 strspn [call site] 00070
3 tinyobj::face_t::face_t() [function] [call site] 00071
3 tinyobj::vertex_index_t::vertex_index_t() [function] [call site] 00072
3 tinyobj::parseTriple(char const**, int, int, int, tinyobj::vertex_index_t*, tinyobj::warning_context const&) [function] [call site] 00073
3 std::__1::basic_string , std::__1::allocator > tinyobj::toString (unsigned long const&) [function] [call site] 00074
3 strspn [call site] 00075
3 tinyobj::face_t::~face_t() [function] [call site] 00076
3 strncmp [call site] 00077
3 tinyobj::parseString(char const**) [function] [call site] 00078
4 strspn [call site] 00079
4 strcspn [call site] 00080
3 tinyobj::exportGroupsToShape(tinyobj::shape_t*, tinyobj::PrimGroup const&, std::__1::vector > const&, int, std::__1::basic_string , std::__1::allocator > const&, bool, std::__1::vector > const&, std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00081
4 tinyobj::PrimGroup::IsEmpty() const [function] [call site] 00082
4 tinyobj::vertex_index_t::vertex_index_t(int) [function] [call site] 00083
4 fabs(float) [function] [call site] 00084
4 fabs(float) [function] [call site] 00085
4 fabs(float) [function] [call site] 00086
4 tinyobj::face_t::face_t(tinyobj::face_t const&) [function] [call site] 00087
4 tinyobj::vertex_index_t::vertex_index_t() [function] [call site] 00088
4 tinyobj::face_t::~face_t() [function] [call site] 00089
4 int tinyobj::pnpoly (int, float*, float*, float, float) [function] [call site] 00090
3 strncmp [call site] 00091
3 tinyobj::SplitString(std::__1::basic_string , std::__1::allocator > const&, char, char, std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > >&) [function] [call site] 00092
3 tinyobj::exportGroupsToShape(tinyobj::shape_t*, tinyobj::PrimGroup const&, std::__1::vector > const&, int, std::__1::basic_string , std::__1::allocator > const&, bool, std::__1::vector > const&, std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00093
3 tinyobj::shape_t::shape_t() [function] [call site] 00094
3 tinyobj::PrimGroup::clear() [function] [call site] 00095
3 tinyobj::parseString(char const**) [function] [call site] 00096
3 strspn [call site] 00097
3 tinyobj::exportGroupsToShape(tinyobj::shape_t*, tinyobj::PrimGroup const&, std::__1::vector > const&, int, std::__1::basic_string , std::__1::allocator > const&, bool, std::__1::vector > const&, std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00098
3 tinyobj::PrimGroup::clear() [function] [call site] 00099
3 tinyobj::shape_t::shape_t() [function] [call site] 00100
3 tinyobj::tag_t::tag_t() [function] [call site] 00101
3 tinyobj::parseString(char const**) [function] [call site] 00102
3 tinyobj::parseTagTriple(char const**) [function] [call site] 00103
4 tinyobj::tag_sizes::tag_sizes() [function] [call site] 00104
4 strspn [call site] 00105
4 atoi [call site] 00106
4 strcspn [call site] 00107
4 strspn [call site] 00108
4 atoi [call site] 00109
4 strcspn [call site] 00110
4 tinyobj::parseInt(char const**) [function] [call site] 00111
3 tinyobj::tag_t::~tag_t() [function] [call site] 00112
3 tinyobj::parseInt(char const**) [function] [call site] 00113
3 tinyobj::parseReal(char const**, double) [function] [call site] 00114
3 tinyobj::parseString(char const**) [function] [call site] 00115
3 strspn [call site] 00116
3 strlen [call site] 00117
3 tinyobj::parseInt(char const**) [function] [call site] 00118
3 tinyobj::exportGroupsToShape(tinyobj::shape_t*, tinyobj::PrimGroup const&, std::__1::vector > const&, int, std::__1::basic_string , std::__1::allocator > const&, bool, std::__1::vector > const&, std::__1::basic_string , std::__1::allocator >*) [function] [call site] 00119
3 tinyobj::PrimGroup::clear() [function] [call site] 00120
3 tinyobj::shape_t::~shape_t() [function] [call site] 00121
2 tinyobj::MaterialStreamReader::~MaterialStreamReader() [function] [call site] 00122
3 tinyobj::MaterialReader::~MaterialReader() [function] [call site] 00123
1 tinyobj::ObjReader::~ObjReader() [function] [call site] 00124
2 tinyobj::attrib_t::~attrib_t() [function] [call site] 00125