Fuzz introspector: png_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
37 37 1 :

['wuffs_png__decoder__decode_chrm']

37 43 wuffs_png__decoder__decode_other_chunk call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:67626
16 16 1 :

['wuffs_png__decoder__decode_gama']

16 22 wuffs_png__decoder__decode_other_chunk call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:67662
16 16 1 :

['wuffs_png__decoder__decode_iccp']

16 22 wuffs_png__decoder__decode_other_chunk call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:67681
12 12 1 :

['wuffs_png__decoder__decode_exif']

12 18 wuffs_png__decoder__decode_other_chunk call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:67581
12 12 1 :

['wuffs_png__decoder__decode_srgb']

12 18 wuffs_png__decoder__decode_other_chunk call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:67700
10 10 1 :

['wuffs_zlib__decoder__set_quirk']

10 1154 wuffs_png__decoder__do_decode_frame call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:69785
2 2 1 :

['wuffs_base__empty_range_ii_u64']

2 2 wuffs_png__decoder__workbuf_len call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:70954
0 2 1 :

['wuffs_base__empty_slice_u8']

0 2 wuffs_base__slice_u8__subslice_j call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:1935
0 2 1 :

['wuffs_base__empty_slice_u8']

0 2 wuffs_base__slice_u8__subslice_i call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:1924
0 2 1 :

['wuffs_base__make_status']

0 2 wuffs_deflate__decoder__decode_huffman_bmi2 call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:41903
0 2 1 :

['wuffs_base__empty_slice_u8']

0 2 wuffs_private_impl__io__since call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:17732
0 2 1 :

['wuffs_base__make_pixel_format']

0 2 wuffs_base__pixel_buffer__pixel_format call site: 00000 /src/wuffs/fuzz/c/std/../../../release/c/wuffs-unsupported-snapshot.c:5557

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 llvmFuzzerTestOneInput [function] [call site] 00001
2 jenkins_hash_u32 [function] [call site] 00002
2 jenkins_hash_u32 [function] [call site] 00003
2 popcount32 [function] [call site] 00004
2 wuffs_base__ptr_u8__reader [function] [call site] 00005
2 fuzz [function] [call site] 00006
3 wuffs_png__decoder__initialize [function] [call site] 00007
4 wuffs_base__make_status [function] [call site] 00008
4 wuffs_base__make_status [function] [call site] 00009
4 wuffs_base__make_status [function] [call site] 00010
4 wuffs_base__make_status [function] [call site] 00011
4 wuffs_crc32__ieee_hasher__initialize [function] [call site] 00012
5 wuffs_base__make_status [function] [call site] 00013
5 wuffs_base__make_status [function] [call site] 00014
5 wuffs_base__make_status [function] [call site] 00015
5 wuffs_base__make_status [function] [call site] 00016
5 wuffs_base__make_status [function] [call site] 00017
4 wuffs_zlib__decoder__initialize [function] [call site] 00018
5 wuffs_base__make_status [function] [call site] 00019
5 wuffs_base__make_status [function] [call site] 00020
5 wuffs_base__make_status [function] [call site] 00021
5 wuffs_base__make_status [function] [call site] 00022
5 wuffs_adler32__hasher__initialize [function] [call site] 00023
6 wuffs_base__make_status [function] [call site] 00024
6 wuffs_base__make_status [function] [call site] 00025
6 wuffs_base__make_status [function] [call site] 00026
6 wuffs_base__make_status [function] [call site] 00027
6 wuffs_base__make_status [function] [call site] 00028
5 wuffs_adler32__hasher__initialize [function] [call site] 00029
5 wuffs_deflate__decoder__initialize [function] [call site] 00030
6 wuffs_base__make_status [function] [call site] 00031
6 wuffs_base__make_status [function] [call site] 00032
6 wuffs_base__make_status [function] [call site] 00033
6 wuffs_base__make_status [function] [call site] 00034
6 wuffs_base__make_status [function] [call site] 00035
5 wuffs_base__make_status [function] [call site] 00036
4 wuffs_base__make_status [function] [call site] 00037
3 wuffs_base__u64__rotate_right [function] [call site] 00038
3 wuffs_base__status__is_ok [function] [call site] 00039
3 wuffs_base__status__message [function] [call site] 00040
3 wuffs_png__decoder__upcast_as__wuffs_base__image_decoder [function] [call site] 00041
3 fuzz_image_decoder [function] [call site] 00042
4 wuffs_base__image_decoder__decode_image_config [function] [call site] 00043
5 wuffs_base__make_status [function] [call site] 00044
5 wuffs_base__make_status [function] [call site] 00045
5 wuffs_base__make_status [function] [call site] 00046
4 wuffs_base__status__is_ok [function] [call site] 00047
4 wuffs_base__status__message [function] [call site] 00048
4 wuffs_base__image_config__is_valid [function] [call site] 00049
5 wuffs_base__pixel_config__is_valid [function] [call site] 00050
4 wuffs_base__pixel_config__width [function] [call site] 00051
4 wuffs_base__pixel_config__height [function] [call site] 00052
4 wuffs_base__pixel_config__set [function] [call site] 00053
4 wuffs_base__image_decoder__workbuf_len [function] [call site] 00054
5 wuffs_base__empty_range_ii_u64 [function] [call site] 00055
5 wuffs_base__empty_range_ii_u64 [function] [call site] 00056
5 wuffs_base__empty_range_ii_u64 [function] [call site] 00057
4 wuffs_base__malloc_slice_u8 [function] [call site] 00058
5 wuffs_base__make_slice_u8 [function] [call site] 00059
5 wuffs_base__empty_slice_u8 [function] [call site] 00060
4 wuffs_base__pixel_config__pixbuf_len [function] [call site] 00061
5 wuffs_base__pixel_format__is_planar [function] [call site] 00062
5 wuffs_base__pixel_format__bits_per_pixel [function] [call site] 00063
5 wuffs_base__pixel_format__is_indexed [function] [call site] 00064
4 wuffs_base__malloc_slice_u8 [function] [call site] 00065
4 wuffs_base__pixel_buffer__set_from_slice [function] [call site] 00066
5 wuffs_base__make_status [function] [call site] 00067
5 wuffs_base__make_status [function] [call site] 00068
5 wuffs_base__pixel_format__is_planar [function] [call site] 00069
5 wuffs_base__make_status [function] [call site] 00070
5 wuffs_base__pixel_format__bits_per_pixel [function] [call site] 00071
5 wuffs_base__make_status [function] [call site] 00072
5 wuffs_base__pixel_format__is_indexed [function] [call site] 00073
5 wuffs_base__make_status [function] [call site] 00074
5 wuffs_base__make_status [function] [call site] 00075
5 wuffs_base__make_status [function] [call site] 00076
5 wuffs_base__make_status [function] [call site] 00077
4 wuffs_base__status__message [function] [call site] 00078
4 wuffs_base__image_decoder__decode_frame_config [function] [call site] 00079
5 wuffs_base__make_status [function] [call site] 00080
5 wuffs_base__make_status [function] [call site] 00081
5 wuffs_base__make_status [function] [call site] 00082
4 wuffs_base__status__message [function] [call site] 00083
4 wuffs_base__image_decoder__decode_frame [function] [call site] 00084
5 wuffs_base__make_status [function] [call site] 00085
5 wuffs_base__make_status [function] [call site] 00086
5 wuffs_base__make_status [function] [call site] 00087
4 wuffs_base__frame_config__bounds [function] [call site] 00088
4 wuffs_base__image_decoder__frame_dirty_rect [function] [call site] 00089
5 wuffs_base__empty_rect_ie_u32 [function] [call site] 00090
5 wuffs_base__empty_rect_ie_u32 [function] [call site] 00091
5 wuffs_base__empty_rect_ie_u32 [function] [call site] 00092
4 wuffs_base__rect_ie_u32__contains_rect [function] [call site] 00093
5 wuffs_base__rect_ie_u32__intersect [function] [call site] 00094
6 wuffs_base__u32__max [function] [call site] 00095
6 wuffs_base__u32__max [function] [call site] 00096
6 wuffs_base__u32__min [function] [call site] 00097
6 wuffs_base__u32__min [function] [call site] 00098
5 wuffs_base__rect_ie_u32__equals [function] [call site] 00099
6 wuffs_base__rect_ie_u32__is_empty [function] [call site] 00100
6 wuffs_base__rect_ie_u32__is_empty [function] [call site] 00101
4 wuffs_base__status__is_ok [function] [call site] 00102
4 wuffs_base__status__message [function] [call site] 00103
4 wuffs_base__rect_ie_u32__equals [function] [call site] 00104
2 strnlen [call site] 00105
2 strstr [call site] 00106
2 fprintf [call site] 00107
2 intentional_segfault [function] [call site] 00108
2 strstr [call site] 00109
2 fprintf [call site] 00110
2 intentional_segfault [function] [call site] 00111