Fuzz introspector: fuzz_encode_stream
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
44 44 1 :

['encode_eopm']

44 60 lzma_lzma_encode call site: 00000 /src/xz/src/liblzma/lzma/lzma_encoder.c:418
4 4 1 :

['move_window']

4 12 fill_window call site: 00000 /src/xz/src/liblzma/lz/lz_encoder.c:87
4 4 2 :

['bsr32', 'ctz32']

4 4 index_tree_append call site: 00032 /src/xz/src/liblzma/common/index.c:239
2 2 1 :

['abort']

2 2 fuzz_code call site: 00081 /src/xz/tests/ossfuzz/./fuzz_common.h:68
0 56 5 :

['keep_high_bytes', 'fold_xor', 'fold', 'my_load128', 'shift_right']

0 60 crc32_arch_optimized call site: 00000 /src/xz/src/liblzma/check/crc_x86_clmul.h:204
0 15 1 :

['index_tree_next']

0 38 lzma_index_iter_next call site: 00000 /src/xz/src/liblzma/common/index.c:1204
0 11 1 :

['lzma_vli_encode']

0 43 lzma_block_header_encode call site: 00000 /src/xz/src/liblzma/common/block_header_encoder.c:99
0 8 2 :

['shift_left', 'read64le']

0 8 crc32_arch_optimized call site: 00000 /src/xz/src/liblzma/check/crc_x86_clmul.h:214
0 8 1 :

['lzma_next_end']

0 8 lzma_raw_coder_init call site: 00066 /src/xz/src/liblzma/common/filter_common.c:343
0 8 1 :

['lzma_free']

0 8 lz_encoder_init call site: 00000 /src/xz/src/liblzma/lz/lz_encoder.c:426
0 6 1 :

['lzma_vli_size']

0 23 lzma_block_header_size call site: 00049 /src/xz/src/liblzma/common/block_header_encoder.c:35
0 4 1 :

['lzma_free']

0 4 lzma_next_end call site: 00010 /src/xz/src/liblzma/common/common.c:158

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fprintf [call site] 00001
1 lzma_lzma_preset [function] [call site] 00002
1 fprintf [call site] 00003
1 abort [call site] 00004
1 lzma_stream_encoder [function] [call site] 00005
2 lzma_strm_init [function] [call site] 00006
3 lzma_alloc [function] [call site] 00007
2 stream_encoder_init [function] [call site] 00008
3 stream_encoder_init [function] [call site] 00009
4 lzma_next_end [function] [call site] 00010
5 lzma_free [function] [call site] 00011
4 lzma_alloc [function] [call site] 00012
4 lzma_index_end [function] [call site] 00013
5 index_tree_end [function] [call site] 00014
6 __assert_fail [call site] 00015
6 index_tree_node_end [function] [call site] 00016
7 index_tree_node_end [function] [call site] 00017
8 index_tree_node_end [function] [call site] 00018
5 index_stream_end [function] [call site] 00019
6 index_tree_end [function] [call site] 00020
6 lzma_free [function] [call site] 00021
6 lzma_free [function] [call site] 00022
5 lzma_free [function] [call site] 00023
4 lzma_index_init [function] [call site] 00024
5 index_init_plain [function] [call site] 00025
6 lzma_alloc [function] [call site] 00026
6 index_tree_init [function] [call site] 00027
5 index_stream_init [function] [call site] 00028
6 lzma_alloc [function] [call site] 00029
6 index_tree_init [function] [call site] 00030
5 lzma_free [function] [call site] 00031
5 index_tree_append [function] [call site] 00032
6 __assert_fail [call site] 00033
6 __assert_fail [call site] 00034
6 bsr32 [function] [call site] 00035
6 ctz32 [function] [call site] 00036
6 __assert_fail [call site] 00037
4 lzma_stream_header_encode [function] [call site] 00038
5 stream_flags_encode [function] [call site] 00039
5 lzma_crc32 [function] [call site] 00040
5 write32ne [function] [call site] 00041
4 stream_encoder_update [function] [call site] 00042
5 lzma_filters_copy [function] [call site] 00043
6 lzma_alloc [function] [call site] 00044
6 __assert_fail [call site] 00045
6 lzma_free [function] [call site] 00046
5 block_encoder_init [function] [call site] 00047
6 lzma_block_header_size [function] [call site] 00048
7 lzma_vli_size [function] [call site] 00049
8 __assert_fail [call site] 00050
7 lzma_vli_size [function] [call site] 00051
7 lzma_filter_flags_size [function] [call site] 00052
8 lzma_properties_size [function] [call site] 00053
9 encoder_find [function] [call site] 00054
8 lzma_vli_size [function] [call site] 00055
6 lzma_block_encoder_init [function] [call site] 00056
7 lzma_block_encoder_init [function] [call site] 00057
8 lzma_next_end [function] [call site] 00058
8 lzma_check_is_supported [function] [call site] 00059
8 lzma_alloc [function] [call site] 00060
8 lzma_check_init [function] [call site] 00061
9 lzma_sha256_init [function] [call site] 00062
8 lzma_raw_encoder_init [function] [call site] 00063
9 lzma_raw_coder_init [function] [call site] 00064
10 lzma_validate_chain [function] [call site] 00065
10 lzma_next_filter_init [function] [call site] 00066
11 lzma_next_end [function] [call site] 00067
10 lzma_next_end [function] [call site] 00068
9 coder_find [function] [call site] 00069
10 encoder_find [function] [call site] 00070
5 lzma_filters_free [function] [call site] 00071
6 __assert_fail [call site] 00072
6 lzma_free [function] [call site] 00073
5 lzma_filters_free [function] [call site] 00074
2 lzma_end [function] [call site] 00075
3 lzma_next_end [function] [call site] 00076
3 lzma_free [function] [call site] 00077
1 fprintf [call site] 00078
1 abort [call site] 00079
1 fuzz_code [function] [call site] 00080
2 lzma_code [function] [call site] 00081
3 __assert_fail [call site] 00082
2 fprintf [call site] 00083
2 abort [call site] 00084
1 lzma_end [function] [call site] 00085