Fuzz introspector: fuzz_decode_stream_mt
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
2 2 1 :

['abort']

2 2 fuzz_code call site: 00064 /src/xz/tests/ossfuzz/./fuzz_common.h:68
0 25 1 :

['lzma_check_update']

4 64 block_decode call site: 00000 /src/xz/src/liblzma/common/block_decoder.c:128
0 12 2 :

['mythread_mutex_destroy', 'mythread_cond_destroy']

0 12 initialize_new_thread call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:597
0 10 2 :

['lzma_free', 'mythread_mutex_destroy']

0 10 stream_decoder_mt_init call site: 00005 /src/xz/src/liblzma/common/stream_decoder_mt.c:1917
0 8 1 :

['lzma_bufcpy']

0 8 copy_or_code call site: 00000 /src/xz/src/liblzma/simple/simple_coder.c:27
0 4 1 :

['lzma_free']

0 4 lzma_next_end call site: 00006 /src/xz/src/liblzma/common/common.c:158
0 0 None 14 91 read_output_and_wait call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:709
0 0 None 14 91 read_output_and_wait call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:835
0 0 None 4 14 block_decode call site: 00000 /src/xz/src/liblzma/common/block_decoder.c:171
0 0 None 2 1807 stream_decode_mt call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:1067
0 0 None 2 1807 stream_decode_mt call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:1260
0 0 None 2 1807 stream_decode_mt call site: 00000 /src/xz/src/liblzma/common/stream_decoder_mt.c:1292

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 lzma_stream_decoder_mt [function] [call site] 00001
2 lzma_strm_init [function] [call site] 00002
3 lzma_alloc [function] [call site] 00003
2 stream_decoder_mt_init [function] [call site] 00004
3 stream_decoder_mt_init [function] [call site] 00005
4 lzma_next_end [function] [call site] 00006
5 lzma_free [function] [call site] 00007
4 lzma_alloc [function] [call site] 00008
4 mythread_mutex_init [function] [call site] 00009
5 pthread_mutex_init [call site] 00010
4 lzma_free [function] [call site] 00011
4 mythread_cond_init [function] [call site] 00012
5 clock_gettime [call site] 00013
5 pthread_condattr_init [call site] 00014
5 pthread_condattr_setclock [call site] 00015
5 pthread_cond_init [call site] 00016
5 pthread_condattr_destroy [call site] 00017
5 pthread_cond_init [call site] 00018
4 mythread_mutex_destroy [function] [call site] 00019
5 pthread_mutex_destroy [call site] 00020
5 __assert_fail [call site] 00021
4 lzma_free [function] [call site] 00022
4 lzma_filters_free [function] [call site] 00023
5 __assert_fail [call site] 00024
5 lzma_free [function] [call site] 00025
4 threads_end [function] [call site] 00026
5 mythread_mutex_unlock [function] [call site] 00027
6 pthread_mutex_unlock [call site] 00028
6 __assert_fail [call site] 00029
5 mythread_mutex_lock [function] [call site] 00030
6 pthread_mutex_lock [call site] 00031
6 __assert_fail [call site] 00032
5 mythread_cond_signal [function] [call site] 00033
6 pthread_cond_signal [call site] 00034
6 __assert_fail [call site] 00035
5 mythread_join [function] [call site] 00036
6 pthread_join [call site] 00037
5 lzma_free [function] [call site] 00038
4 lzma_outq_init [function] [call site] 00039
5 move_head_to_cache [function] [call site] 00040
6 __assert_fail [call site] 00041
6 __assert_fail [call site] 00042
6 __assert_fail [call site] 00043
6 lzma_outq_clear_cache [function] [call site] 00044
7 free_one_cached_buffer [function] [call site] 00045
8 __assert_fail [call site] 00046
8 lzma_outq_outbuf_memusage [function] [call site] 00047
9 __assert_fail [call site] 00048
8 lzma_free [function] [call site] 00049
6 lzma_outq_outbuf_memusage [function] [call site] 00050
5 free_one_cached_buffer [function] [call site] 00051
4 stream_decoder_reset [function] [call site] 00052
5 lzma_index_hash_init [function] [call site] 00053
6 lzma_alloc [function] [call site] 00054
6 lzma_check_init [function] [call site] 00055
7 lzma_sha256_init [function] [call site] 00056
6 lzma_check_init [function] [call site] 00057
2 lzma_end [function] [call site] 00058
3 lzma_next_end [function] [call site] 00059
3 lzma_free [function] [call site] 00060
1 fprintf [call site] 00061
1 abort [call site] 00062
1 fuzz_code [function] [call site] 00063
2 lzma_code [function] [call site] 00064
3 __assert_fail [call site] 00065
2 fprintf [call site] 00066
2 abort [call site] 00067
1 lzma_end [function] [call site] 00068