Fuzz introspector: inspector/light/source_fileszlib_uncompress2_fuzzer.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
14 14 2 :

['crc_word_big', 'byte_swap']

14 14 crc32_z call site: 00013 /src/zlib/crc32.c:731
8 8 2 :

['malloc', 'strlen']

8 8 gz_error call site: 00000 /src/zlib/gzlib.c:546
4 17 3 :

['__errno_location', 'strerror', 'gz_error']

4 17 gz_load call site: 00000 /src/zlib/gzread.c:27
2 2 1 :

['perror']

2 2 file_compress call site: 00000 /src/minigzip_fuzzer.c:385
2 2 1 :

['perror']

2 2 file_uncompress call site: 00000 /src/minigzip_fuzzer.c:434
0 510 1 :

['gz_zero']

2 1048 gzclose_w call site: 00000 /src/zlib/gzwrite.c:609
0 510 1 :

['gz_zero']

0 2016 gz_write call site: 00000 /src/zlib/gzwrite.c:185
0 502 1 :

['gz_comp']

0 502 gzvprintf call site: 00000 /src/zlib/gzwrite.c:418
0 423 1 :

['gz_skip']

0 1230 gz_read call site: 00000 /src/zlib/gzread.c:277
0 70 1 :

['deflateReset']

6 505 gz_comp call site: 00000 /src/zlib/gzwrite.c:90
0 59 3 :

['_tr_stored_block', 'read_buf', 'flush_pending']

0 59 deflate_stored call site: 00000 /src/zlib/deflate.c:1757
0 25 1 :

['gzrewind']

0 25 gzseek64 call site: 00000 /src/zlib/gzlib.c:387

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 uncompress2 [function] [call site] 00001
2 inflateInit_ [function] [call site] 00002
3 inflateInit2_ [function] [call site] 00003
4 inflateReset2 [function] [call site] 00004
5 inflateStateCheck [function] [call site] 00005
5 inflateReset [function] [call site] 00006
6 inflateStateCheck [function] [call site] 00007
6 inflateResetKeep [function] [call site] 00008
7 inflateStateCheck [function] [call site] 00009
2 inflate [function] [call site] 00010
3 inflateStateCheck [function] [call site] 00011
3 crc32 [function] [call site] 00012
4 crc32_z [function] [call site] 00013
5 crc_word [function] [call site] 00014
5 crc_word [function] [call site] 00015
5 crc_word [function] [call site] 00016
5 crc_word [function] [call site] 00017
5 crc_word [function] [call site] 00018
5 byte_swap [function] [call site] 00019
5 crc_word_big [function] [call site] 00020
5 crc_word_big [function] [call site] 00021
5 crc_word_big [function] [call site] 00022
5 crc_word_big [function] [call site] 00023
5 crc_word_big [function] [call site] 00024
5 byte_swap [function] [call site] 00025
3 crc32 [function] [call site] 00026
3 adler32 [function] [call site] 00027
4 adler32_z [function] [call site] 00028
3 crc32 [function] [call site] 00029
3 crc32 [function] [call site] 00030
3 crc32 [function] [call site] 00031
3 crc32 [function] [call site] 00032
3 crc32 [function] [call site] 00033
3 crc32 [function] [call site] 00034
3 crc32 [function] [call site] 00035
3 crc32 [function] [call site] 00036
3 adler32 [function] [call site] 00037
3 fixedtables [function] [call site] 00038
3 inflate_table [function] [call site] 00039
3 inflate_table [function] [call site] 00040
3 inflate_table [function] [call site] 00041
3 inflate_fast [function] [call site] 00042
3 crc32 [function] [call site] 00043
3 adler32 [function] [call site] 00044
3 updatewindow [function] [call site] 00045
3 crc32 [function] [call site] 00046
3 adler32 [function] [call site] 00047
2 inflateEnd [function] [call site] 00048
3 inflateStateCheck [function] [call site] 00049