Fuzz introspector: inspector/source-codezlib_uncompress3_fuzzer.cc
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
14 14 2 :

['byte_swap', 'crc_word_big']

14 14 crc32_z call site: 00013 /src/zlib/crc32.c:731
8 8 2 :

['strlen', 'malloc']

8 8 gz_error call site: 00000 /src/zlib/gzlib.c:546
7 14 2 :

['_tr_stored_block', '_tr_align']

7 38 deflate call site: 00000 /src/zlib/deflate.c:1211
4 17 3 :

['gz_error', '__errno_location', 'strerror']

4 17 gz_load call site: 00000 /src/zlib/gzread.c:27
2 417 2 :

['gz_fetch', 'memchr']

2 417 gzgets call site: 00000 /src/zlib/gzread.c:532
2 2 1 :

['perror']

2 2 file_compress call site: 00000 /src/minigzip_fuzzer.c:385
2 2 1 :

['perror']

2 2 file_uncompress call site: 00000 /src/minigzip_fuzzer.c:434
0 510 1 :

['gz_zero']

2 1048 gzclose_w call site: 00000 /src/zlib/gzwrite.c:609
0 510 1 :

['gz_zero']

0 2016 gz_write call site: 00000 /src/zlib/gzwrite.c:185
0 510 1 :

['gz_zero']

0 1012 gzvprintf call site: 00000 /src/zlib/gzwrite.c:381
0 510 1 :

['gz_zero']

0 1012 gzflush call site: 00000 /src/zlib/gzwrite.c:545
0 502 1 :

['gz_comp']

0 502 gzvprintf call site: 00000 /src/zlib/gzwrite.c:418

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 uncompress2 [function] [call site] 00001
2 inflateInit_ [function] [call site] 00002
3 inflateInit2_ [function] [call site] 00003
4 inflateReset2 [function] [call site] 00004
5 inflateStateCheck [function] [call site] 00005
5 inflateReset [function] [call site] 00006
6 inflateStateCheck [function] [call site] 00007
6 inflateResetKeep [function] [call site] 00008
7 inflateStateCheck [function] [call site] 00009
2 inflate [function] [call site] 00010
3 inflateStateCheck [function] [call site] 00011
3 crc32 [function] [call site] 00012
4 crc32_z [function] [call site] 00013
5 crc_word [function] [call site] 00014
5 crc_word [function] [call site] 00015
5 crc_word [function] [call site] 00016
5 crc_word [function] [call site] 00017
5 crc_word [function] [call site] 00018
5 byte_swap [function] [call site] 00019
5 crc_word_big [function] [call site] 00020
5 crc_word_big [function] [call site] 00021
5 crc_word_big [function] [call site] 00022
5 crc_word_big [function] [call site] 00023
5 crc_word_big [function] [call site] 00024
5 byte_swap [function] [call site] 00025
3 crc32 [function] [call site] 00026
3 adler32 [function] [call site] 00027
4 adler32_z [function] [call site] 00028
3 crc32 [function] [call site] 00029
3 crc32 [function] [call site] 00030
3 crc32 [function] [call site] 00031
3 crc32 [function] [call site] 00032
3 crc32 [function] [call site] 00033
3 crc32 [function] [call site] 00034
3 crc32 [function] [call site] 00035
3 crc32 [function] [call site] 00036
3 adler32 [function] [call site] 00037
3 fixedtables [function] [call site] 00038
3 inflate_table [function] [call site] 00039
3 inflate_table [function] [call site] 00040
3 inflate_table [function] [call site] 00041
3 inflate_fast [function] [call site] 00042
3 crc32 [function] [call site] 00043
3 adler32 [function] [call site] 00044
3 updatewindow [function] [call site] 00045
3 crc32 [function] [call site] 00046
3 adler32 [function] [call site] 00047
2 inflateEnd [function] [call site] 00048
3 inflateStateCheck [function] [call site] 00049