Target oracle

This page shows functions across the entire OSS-Fuzz database that are determined to be likely interesting targets. This suggestion comes from various heuristics that often encapsulate functions that are likely good to fuzz or are, perhaps, easy to fuzz. For each suggestion a justification is included as to why this target is interesting, by way of referencing a given heuristic.

Function name	Project	Language	Reason	Coverage link
dav_move_file	civetweb	c	heuristic 3	coverage link
mg_send_mime_file	civetweb	c	heuristic 3	coverage link
mg_send_file	civetweb	c	heuristic 3	coverage link
handle_cgi_request	civetweb	c	heuristic 3	coverage link
delete_file	civetweb	c	heuristic 3	coverage link
xfr_probe_send_probe	unbound	c	heuristic 3	coverage link
xfr_transfer_init_fetch	unbound	c	heuristic 3	coverage link
process_list_end_transfer	unbound	c	heuristic 3	coverage link
auth_xfer_pickup_initial	unbound	c	heuristic 3	coverage link
ub_ctx_data_remove	unbound	c	heuristic 3	coverage link
allocate_idx_list	net-snmp	c++	heuristic 3	coverage link
release_idx_list	net-snmp	c++	heuristic 3	coverage link
register_string_index	net-snmp	c++	heuristic 3	coverage link
unregister_string_index	net-snmp	c++	heuristic 3	coverage link
remove_index	net-snmp	c++	heuristic 3	coverage link
cjpeg_main	libjpeg-turbo	c	heuristic 3	coverage link
jpeg_start_compress	libjpeg-turbo	c	heuristic 3	coverage link
encode_mcu_huff	libjpeg-turbo	c	heuristic 3	coverage link
PJ_OPERATION_LIST::getPreparedOperations(pj_ctx*)	proj4	c++	heuristic 3	coverage link
proj_factors	proj4	c++	heuristic 3	coverage link
create_operation_geocentric_crs_to_geog_crs(pj_ctx,PJconstsconst)	proj4	c++	heuristic 3	coverage link
create_operation_to_geog_crs(pj_ctx,PJconstsconst)	proj4	c++	heuristic 3	coverage link
osgeo::proj::crs::BoundCRS::_identify(std::__1::shared_ptr<osgeo::proj::io::AuthorityFactory>const&)const	proj4	c++	heuristic 3	coverage link
capnp::DynamicStruct::Builder::adopt(capnp::StructSchema::Field,capnp::Orphan<capnp::DynamicValue>&&)	capnproto	c++	heuristic 3	coverage link
capnp::DynamicStruct::Builder::set(capnp::StructSchema::Field,capnp::DynamicValue::Readerconst&)	capnproto	c++	heuristic 3	coverage link
capnp::DynamicList::Builder::adopt(unsignedint,capnp::Orphan<capnp::DynamicValue>&&)	capnproto	c++	heuristic 3	coverage link
kj::_::pollImpl(kj::_::PromiseNode&,kj::WaitScope&,kj::SourceLocation)	capnproto	c++	heuristic 3	coverage link
kj::WaitScope::poll(unsignedint)	capnproto	c++	heuristic 3	coverage link
Tss2_Sys_GetCapability_Complete	tpm2-tss	c++	heuristic 3	coverage link
dumpstate	tpm2-tss	c++	heuristic 3	coverage link
Tss2_Sys_ContextSave	tpm2-tss	c++	heuristic 3	coverage link
Tss2_Sys_FlushContext	tpm2-tss	c++	heuristic 3	coverage link
Tss2_Sys_Quote_Complete	tpm2-tss	c++	heuristic 3	coverage link
wxFontMapperBase::CharsetToEncoding(wxStringconst&,bool)	wxwidgets	c++	heuristic 3	coverage link
wxFontMapperBase::NonInteractiveCharsetToEncoding(wxStringconst&)	wxwidgets	c++	heuristic 3	coverage link
wxGetValuesFromOSRelease(wxStringconst&,wxLinuxDistributionInfo&)	wxwidgets	c++	heuristic 3	coverage link
wxFontMapperBase::ChangePath(wxStringconst&,wxString*)	wxwidgets	c++	heuristic 3	coverage link
wxFileTranslationsLoader::LoadCatalog(wxStringconst&,wxStringconst&)	wxwidgets	c++	heuristic 3	coverage link
cmd_new_session_exec	tmux	c	heuristic 3	coverage link
cmd_attach_session_exec	tmux	c	heuristic 3	coverage link
server_client_open	tmux	c	heuristic 3	coverage link
tty_open	tmux	c	heuristic 3	coverage link
server_accept	tmux	c	heuristic 3	coverage link
x86_decode_insn	xen	c	heuristic 3	coverage link
uriParseSingleUriW	uriparser	c++	heuristic 3	coverage link
uriParseUriW	uriparser	c++	heuristic 3	coverage link
uriParseUriExW	uriparser	c++	heuristic 3	coverage link
uriParseSingleUriA	uriparser	c++	heuristic 3	coverage link
uriNormalizeSyntaxMaskRequiredExA	uriparser	c++	heuristic 3	coverage link
op_open_file	opusfile	c	heuristic 3	coverage link
op_raw_seek	opusfile	c	heuristic 3	coverage link
op_test_memory	opusfile	c	heuristic 3	coverage link
op_test_close_on_failure	opusfile	c	heuristic 3	coverage link
op_test_file	opusfile	c	heuristic 3	coverage link
js_bigfloat_to_string	quickjs	c	heuristic 3	coverage link
handle_posted_message	quickjs	c	heuristic 3	coverage link
js_mul_pow10_to_float64	quickjs	c	heuristic 3	coverage link
js_async_generator_resume_next	quickjs	c	heuristic 3	coverage link
JS_ToQuotedStringFree	quickjs	c	heuristic 3	coverage link
ethernet_input	tinyusb	c++	heuristic 3	coverage link
http_accept	tinyusb	c++	heuristic 3	coverage link
http_send	tinyusb	c++	heuristic 3	coverage link
netif_input	tinyusb	c++	heuristic 3	coverage link
http_check_eof	tinyusb	c++	heuristic 3	coverage link
json_dump_file	jansson	c++	heuristic 3	coverage link
json_dumpf	jansson	c++	heuristic 3	coverage link
json_dumpfd	jansson	c++	heuristic 3	coverage link
strtod__unused	jansson	c++	heuristic 3	coverage link
json_loadfd	jansson	c++	heuristic 3	coverage link
exprtk::details::expression_node<double>exprtk::parser<double>::parse_function_call<10ul>(exprtk::ifunction<double>,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>const&)	exprtk	c++	heuristic 3	coverage link
exprtk::parser<double>::parse_generic_function_call(exprtk::igeneric_function<double>*,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>const&)	exprtk	c++	heuristic 3	coverage link
exprtk::details::expression_node<double>exprtk::parser<double>::parse_function_call<9ul>(exprtk::ifunction<double>,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>const&)	exprtk	c++	heuristic 3	coverage link
exprtk::details::expression_node<double>exprtk::parser<double>::parse_function_call<7ul>(exprtk::ifunction<double>,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>const&)	exprtk	c++	heuristic 3	coverage link
exprtk::parser<float>::parse_vararg_function_call(exprtk::ivararg_function<float>*,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>const&)	exprtk	c++	heuristic 3	coverage link
nlstdir	proftpd	c	heuristic 3	coverage link
log_sess_reinit_ev	proftpd	c	heuristic 3	coverage link
nlstfile	proftpd	c	heuristic 3	coverage link
transmit_normal	proftpd	c	heuristic 3	coverage link
facts_mlinfobuf_add	proftpd	c	heuristic 3	coverage link
OSSL_CMP_CTX_server_perform	openssl	c++	heuristic 3	coverage link
check_msg_given_cert	openssl	c++	heuristic 3	coverage link
check_cert_path_3gpp	openssl	c++	heuristic 3	coverage link
SSL_CTX_set_srp_username	openssl	c++	heuristic 3	coverage link
tls_process_client_certificate	openssl	c++	heuristic 3	coverage link
tinygltf::SerializeGltfModel(tinygltf::Modelconst*,nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>&)	tinygltf	c++	heuristic 3	coverage link
boolnlohmann::detail::parser<nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>,nlohmann::detail::iterator_input_adapter<charconst>>::sax_parse_internal<nlohmann::detail::json_sax_dom_callback_parser<nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>>>(nlohmann::detail::json_sax_dom_callback_parser<nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>>)	tinygltf	c++	heuristic 3	coverage link
tinygltf::SerializeGltfMaterial(tinygltf::Materialconst&,nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>&)	tinygltf	c++	heuristic 3	coverage link
stbi_is_16_bit_from_callbacks	tinygltf	c++	heuristic 3	coverage link
tinygltf::SerializeGltfAnimation(tinygltf::Animationconst&,nlohmann::basic_json<std::__1::map,std::__1::vector,std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,bool,long,unsignedlong,double,std::__1::allocator,nlohmann::adl_serializer,std::__1::vector<unsignedchar,std::__1::allocator<unsignedchar>>>&)	tinygltf	c++	heuristic 3	coverage link
fuzz_main	qubes-os	c++	heuristic 3	coverage link
load_service_config	qubes-os	c++	heuristic 3	coverage link
qrexec_process_io	qubes-os	c++	heuristic 3	coverage link
select_loop	qubes-os	c++	heuristic 3	coverage link
handshake_and_go	qubes-os	c++	heuristic 3	coverage link
muduo::TimeZone::loadZoneFile(charconst*)	muduo	c++	heuristic 3	coverage link
run_tidy_parser	tidy-html5	c++	heuristic 3	coverage link
prvTidyParseBlock	tidy-html5	c++	heuristic 3	coverage link
prvTidyParseBody	tidy-html5	c++	heuristic 3	coverage link
prvTidyParseList	tidy-html5	c++	heuristic 3	coverage link
prvTidyParseHead	tidy-html5	c++	heuristic 3	coverage link
gen_broadcast	libpcap	c++	heuristic 3	coverage link
gen_geneve4	libpcap	c++	heuristic 3	coverage link
gen_geneve	libpcap	c++	heuristic 3	coverage link
gen_vlan_bpf_extensions	libpcap	c++	heuristic 3	coverage link
gen_inbound	libpcap	c++	heuristic 3	coverage link
create_thread	lwan	c++	heuristic 3	coverage link
fastcgi_handle_request	lwan	c++	heuristic 3	coverage link
setup_from_config	lwan	c++	heuristic 3	coverage link
try_setup_from_config	lwan	c++	heuristic 3	coverage link
lwan_init_with_config	lwan	c++	heuristic 3	coverage link
X509dump	plan9port	c	heuristic 3	coverage link
X509req	plan9port	c	heuristic 3	coverage link
X509verify	plan9port	c	heuristic 3	coverage link
rsadecrypt	plan9port	c	heuristic 3	coverage link
_p9zonelookuptinfo	plan9port	c	heuristic 3	coverage link
bam_index_build	htslib	c++	heuristic 3	coverage link
sam_index_build2	htslib	c++	heuristic 3	coverage link
sam_index_build	htslib	c++	heuristic 3	coverage link
bcf_index_build	htslib	c++	heuristic 3	coverage link
bcf_index_build2	htslib	c++	heuristic 3	coverage link
rfbRunEventLoop	libvnc	c++	heuristic 3	coverage link
rfbProcessEvents	libvnc	c++	heuristic 3	coverage link
rfbSendFramebufferUpdate	libvnc	c++	heuristic 3	coverage link
rfbReverseConnection	libvnc	c++	heuristic 3	coverage link
rfbCheckFds	libvnc	c++	heuristic 3	coverage link
coap_ws_read	libcoap	c++	heuristic 3	coverage link
coap_dispatch	libcoap	c++	heuristic 3	coverage link
coap_oscore_decrypt_pdu	libcoap	c++	heuristic 3	coverage link
handle_request	libcoap	c++	heuristic 3	coverage link
coap_new_endpoint	libcoap	c++	heuristic 3	coverage link
boost::json::operator>>(std::__1::basic_istream<char,std::__1::char_traits<char>>&,boost::json::value&)	boost-json	c++	heuristic 3	coverage link
boost::json::stream_parser::finish(std::__1::error_code&)	boost-json	c++	heuristic 3	coverage link
boost::json::stream_parser::write(charconst*,unsignedlong)	boost-json	c++	heuristic 3	coverage link
boost::json::parser::write(charconst*,unsignedlong)	boost-json	c++	heuristic 3	coverage link
boost::json::parser::write_some(charconst*,unsignedlong)	boost-json	c++	heuristic 3	coverage link
pg_query_parse_protobuf_opts	libpg_query	c	heuristic 3	coverage link
pg_query_parse_protobuf	libpg_query	c	heuristic 3	coverage link
_outQuery	libpg_query	c	heuristic 3	coverage link
_outRangeTblEntry	libpg_query	c	heuristic 3	coverage link
_outCreateTrigStmt	libpg_query	c	heuristic 3	coverage link
Gfx::opSetExtGState(Object*,int)	xpdf	c++	heuristic 3	coverage link
SplashOutputDev::doUpdateFont(GfxState*)	xpdf	c++	heuristic 3	coverage link
Gfx::opShowSpaceText(Object*,int)	xpdf	c++	heuristic 3	coverage link
Gfx::opShowText(Object*,int)	xpdf	c++	heuristic 3	coverage link
Gfx::doShowText(GString*)	xpdf	c++	heuristic 3	coverage link
pdf_save_snapshot	mupdf	c++	heuristic 3	coverage link
pdf_update_widget	mupdf	c++	heuristic 3	coverage link
pdf_writer_close_writer	mupdf	c++	heuristic 3	coverage link
pdf_write_snapshot	mupdf	c++	heuristic 3	coverage link
pdf_clear_signature	mupdf	c++	heuristic 3	coverage link
FrameCodeI	xvid	c++	heuristic 3	coverage link
FrameCodeP	xvid	c++	heuristic 3	coverage link
FrameCodeB	xvid	c++	heuristic 3	coverage link
enc_encode	xvid	c++	heuristic 3	coverage link

Heuristics

Heuristic 1

This is the heuristic highlights functions that has all of the following attributes:

- Has "parse" in its function name.
- Has zero percentage code coverage.
- Has accumulated cyclomatic complexity larger than 200.
- Is in a project written in C or C++.

Heuristic 2

This is the heuristic highlights functions that has all of the following attributes:

- Has two arguments.
- First argument has type "char *".
- Second argument has type "int".
- Has accumulated cyclomatic complexity larger than 150