Project: pigweed

Language c++
OSS-Fuzz project link
Project repository link
Build status: Fuzzers succeeding: Build log
Build status: Code coverage succeeding: Build log
Build status: Fuzz Introspector succeeding: Build log
Fuzzer count 15
Lines of code 32868
Lines covered 10837
Code coverage 32.97%
Code coverage report Report link
Static reachability 21.77%
Fuzz Introspector report Report link (from 2025-03-27)
Fuzzer Code coverage (lines) Latest Report Comments
advertising_data_fuzzer 45.03% (avg: 45.16%, max: 45.28%) 2025-03-27
basic_mode_rx_engine_fuzzer 21.78% (avg: 21.73%, max: 21.74%) 2025-03-27
bredr_dynamic_channel_registry_fuzzer 35.82% (avg: 33.75%, max: 35.97%) 2025-03-27
channel_configuration_fuzzer 24.19% (avg: 24.18%, max: 24.19%) 2025-03-27
common_handler_fuzzer 10.1% (avg: 10.09%, max: 10.1%) 2025-03-27
data_element_fuzzer 32.21% (avg: 32.32%, max: 32.42%) 2025-03-27
decoder_fuzz_test 35.1% (avg: 35.1%, max: 35.1%) 2025-03-27
detokenize_fuzzer 8.86% (avg: 9.65%, max: 10.64%) 2025-03-27
encoder_fuzz_test 34.02% (avg: 34.02%, max: 34.02%) 2025-03-27
enhanced_retransmission_mode_engines_fuzzer 51.02% (avg: 51.14%, max: 51.17%) 2025-03-27
l2cap_fuzzer 27.87% (avg: 21.25%, max: 27.98%) 2025-03-27
pdu_fuzzer 38.05% (avg: 38.13%, max: 38.21%) 2025-03-27
peer_cache_fuzzer 19.98% (avg: 12.69%, max: 19.99%) 2025-03-27
uart_transport_fuzzer 36.59% (avg: 36.59%, max: 36.59%) 2025-03-27
valid_packet_reader_fuzzer 18.85% (avg: 18.91%, max: 18.93%) 2025-03-27

Historical Progression

Per Fuzzer Progression

Functions of interest to fuzz

This section outlines functions that may be of interest to fuzz. They are based on ranking functions that have a lot of complexity but currently exhibit low code coverage. The complexity is calculated based on the function itself as well as the functions called by the given function, i.e. the tree of code that the function triggers.


This is only a minor amount of introspection information available for this project. Please consult the Fuzz Introspector report for more information, e.g. the introspection table of all functions in the target project available here.

Function name Function source file Accumulated cyclomatic complexity Code coverage
testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/googletest+/googletest/src/gtest.cc 2877 0.0%
fit::internal::target<bt::l2cap::A2dpOffloadManager::StartA2dpOffload(bt::l2cap::A2dpOffloadManager::Configurationconst&,unsignedshort,unsignedshort,unsignedshort,unsignedshort,fit::callback_impl<16ul,false,void(fit::result<bt::Error<pw::bluetooth::emboss::StatusCode>>),std::__1::allocator<std::byte>>)::$_0,false,false,std::__1::allocator<std::byte>,void,unsignedlong,bt::hci::EventPacketconst&>::invoke(void*,unsignedlong,bt::hci::EventPacketconst&) /proc/self/cwd/third_party/fuchsia/repo/sdk/lib/fit/include/lib/fit/internal/function.h 1909 0.0%
autobt::l2cap::A2dpOffloadManager::StartA2dpOffload(bt::l2cap::A2dpOffloadManager::Configurationconst&,unsignedshort,unsignedshort,unsignedshort,unsignedshort,fit::callback_impl<16ul,false,void(fit::result<bt::Error<pw::bluetooth::emboss::StatusCode>>),std::__1::allocator<std::byte>>)::$_0::operator()<unsignedlong>(unsignedlong,bt::hci::EventPacketconst&) /proc/self/cwd/pw_bluetooth_sapphire/host/l2cap/a2dp_offload_manager.cc 1907 0.0%
bt::l2cap::internal::ChannelImpl::StartA2dpOffload(bt::l2cap::A2dpOffloadManager::Configurationconst&,fit::callback_impl<16ul,false,void(fit::result<bt::Error<pw::bluetooth::emboss::StatusCode>>),std::__1::allocator<std::byte>>) /proc/self/cwd/pw_bluetooth_sapphire/host/l2cap/channel.cc 1668 16.41%
bt::l2cap::A2dpOffloadManager::StartA2dpOffload(bt::l2cap::A2dpOffloadManager::Configurationconst&,unsignedshort,unsignedshort,unsignedshort,unsignedshort,fit::callback_impl<16ul,false,void(fit::result<bt::Error<pw::bluetooth::emboss::StatusCode>>),std::__1::allocator<std::byte>>) /proc/self/cwd/pw_bluetooth_sapphire/host/l2cap/a2dp_offload_manager.cc 1652 16.41%
bt::gap::PeerCache::AddBondedPeer(bt::gap::BondingData) /proc/self/cwd/pw_bluetooth_sapphire/host/gap/peer_cache.cc 1627 0.0%
testing::internal::UnitTestImpl::ListTestsMatchingFilter() /proc/self/cwd/external/googletest+/googletest/src/gtest.cc 1485 0.0%
testing::InitGoogleTest(int*,wchar_t**) /proc/self/cwd/external/googletest+/googletest/src/gtest.cc 1271 0.0%
voidtesting::internal::InitGoogleTestImpl<wchar_t>(int*,wchar_t**) /proc/self/cwd/external/googletest+/googletest/src/gtest.cc 1269 0.0%
fit::internal::target<bt::l2cap::internal::ChannelImpl::ChannelImpl(pw::async::Dispatcher&,unsignedshort,unsignedshort,WeakPtr<bt::l2cap::internal::LogicalLink,DynamicWeakManager<bt::l2cap::internal::LogicalLink>>,bt::l2cap::ChannelInfo,WeakPtr<bt::hci::CommandChannel,DynamicWeakManager<bt::hci::CommandChannel>>,unsignedshort,bt::l2cap::A2dpOffloadManager&,unsignedshort)::$_0,true,false,std::__1::allocator<std::byte>,void>::invoke(void*) /proc/self/cwd/third_party/fuchsia/repo/sdk/lib/fit/include/lib/fit/internal/function.h 1232 0.0%