Fuzz introspector: json_load_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
30 30 4 :

['strncat', 'fputc', 'fputs', 'strlen']

30 30 loader_log call site: 00009 /src/vulkan-loader/loader/log.c:159
0 0 None 95 95 loader_log call site: 00008 /src/vulkan-loader/loader/log.c:99
0 0 None 30 30 loader_log call site: 00008 /src/vulkan-loader/loader/log.c:104
0 0 None 2 289 loader_get_json call site: 00038 /src/vulkan-loader/loader/cJSON.c:1274
0 0 None 2 139 loader_get_json call site: 00034 /src/vulkan-loader/loader/cJSON.c:1268
0 0 None 2 2 loader_calloc call site: 00035 /src/vulkan-loader/loader/allocation.c:56
0 0 None 0 0 loader_alloc call site: 00044 /src/vulkan-loader/loader/allocation.c:39
0 0 None 0 0 loader_free call site: 00029 /src/vulkan-loader/loader/allocation.c:76
0 0 None 0 0 cJSON_ParseWithOpts call site: 00046 /src/vulkan-loader/loader/cJSON.c:472

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 getpid [call site] 00001
1 fopen [call site] 00002
1 fwrite [call site] 00003
1 fclose [call site] 00004
1 loader_get_json [function] [call site] 00005
2 fopen [call site] 00006
2 loader_log [function] [call site] 00007
3 vsnprintf [call site] 00008
3 util_SubmitDebugUtilsMessageEXT [function] [call site] 00009
4 debug_utils_AnnotFlagsToReportFlags [function] [call site] 00010
4 debug_utils_AnnotObjectToDebugReportObject [function] [call site] 00011
5 convertCoreObjectToDebugReportObject [function] [call site] 00012
3 strlen [call site] 00013
3 strlen [call site] 00014
3 strlen [call site] 00015
3 strlen [call site] 00016
3 strncat [call site] 00017
3 strncat [call site] 00018
3 strncat [call site] 00019
3 strncat [call site] 00020
3 strncat [call site] 00021
3 strncat [call site] 00022
3 strncat [call site] 00023
3 strncat [call site] 00024
3 fputs [call site] 00025
3 fputs [call site] 00026
3 fputc [call site] 00027
2 loader_instance_heap_free [function] [call site] 00028
3 loader_free [function] [call site] 00029
2 fread [call site] 00030
2 feof [call site] 00031
2 ftell [call site] 00032
2 fseek [call site] 00033
2 loader_instance_heap_calloc [function] [call site] 00034
3 loader_calloc [function] [call site] 00035
4 calloc [call site] 00036
2 loader_log [function] [call site] 00037
2 fread [call site] 00038
2 loader_log [function] [call site] 00039
2 cJSON_Parse [function] [call site] 00040
3 cJSON_ParseWithOpts [function] [call site] 00041
4 cJSON_New_Item [function] [call site] 00042
5 cJSON_malloc [function] [call site] 00043
6 loader_alloc [function] [call site] 00044
4 cJSON_Delete [function] [call site] 00046
5 cJSON_Delete [function] [call site] 00047
6 cJSON_Free [function] [call site] 00048
7 loader_free [function] [call site] 00049
6 cJSON_Free [function] [call site] 00050
6 cJSON_Free [function] [call site] 00051
4 cJSON_Delete [function] [call site] 00053
2 loader_log [function] [call site] 00054
2 fclose [call site] 00055
2 cJSON_Delete [function] [call site] 00056
1 unlink [call site] 00057