Target oracle

This page shows functions across the entire OSS-Fuzz database that are determined to be likely interesting targets. This suggestion comes from various heuristics that often encapsulate functions that are likely good to fuzz or are, perhaps, easy to fuzz. For each suggestion a justification is included as to why this target is interesting, by way of referencing a given heuristic.

Function name	Project	Language	Reason	Coverage link
PngMutator::PngMutator(std::__1::basic_istream<char,std::__1::char_traits<char>>&)	libspng	c++	heuristic 3	coverage link
spng_decoded_image_size	libspng	c++	heuristic 3	coverage link
spng_set_trns	libspng	c++	heuristic 3	coverage link
spng_set_unknown_chunks	libspng	c++	heuristic 3	coverage link
spng_set_gama_int	libspng	c++	heuristic 3	coverage link
exprtk::parser<double>::parse_pending_vector_index_operator(exprtk::details::expression_node<double>*&)	exprtk	c++	heuristic 3	coverage link
exprtk::parser<double>::expression_generator<double>::synthesize_assignment_operation_expression(exprtk::details::operator_typeconst&,exprtk::details::expression_node<double>*(&)[2])	exprtk	c++	heuristic 3	coverage link
exprtk::parser<float>::parse_pending_vector_index_operator(exprtk::details::expression_node<float>*&)	exprtk	c++	heuristic 3	coverage link
exprtk::parser<float>::expression_generator<float>::special_function(exprtk::details::operator_typeconst&,exprtk::details::expression_node<float>*(&)[3])	exprtk	c++	heuristic 3	coverage link
exprtk::parser<double>::expression_generator<double>::special_function(exprtk::details::operator_typeconst&,exprtk::details::expression_node<double>*(&)[3])	exprtk	c++	heuristic 3	coverage link
fu_util_firmware_read	fwupd	c	heuristic 3	coverage link
fu_util_esp_list	fwupd	c	heuristic 3	coverage link
fu_util_bind_driver	fwupd	c	heuristic 3	coverage link
fu_util_install_blob	fwupd	c	heuristic 3	coverage link
fu_util_firmware_dump	fwupd	c	heuristic 3	coverage link
WavpackSeekSample	wavpack	c++	heuristic 3	coverage link
vp8_post_proc_frame	libvpx	c++	heuristic 3	coverage link
row_decode_worker_hook	libvpx	c++	heuristic 3	coverage link
vp9_loopfilter_job	libvpx	c++	heuristic 3	coverage link
cli_bytecode_prepare2	clamav	c++	heuristic 3	coverage link
rtf_object_process	clamav	c++	heuristic 3	coverage link
Pages_cb	clamav	c++	heuristic 3	coverage link
Subject_cb	clamav	c++	heuristic 3	coverage link
Keywords_cb	clamav	c++	heuristic 3	coverage link
espeak_ng_STATUS::espeak_ng_InitializeOutput	espeak-ng	c++	heuristic 3	coverage link
create_events	espeak-ng	c++	heuristic 3	coverage link
Synthesize	espeak-ng	c++	heuristic 3	coverage link
espeak_TextToPhonemes	espeak-ng	c++	heuristic 3	coverage link
ucd::properties	espeak-ng	c++	heuristic 3	coverage link
load_service_config	qubes-os	c++	heuristic 3	coverage link
qrexec_process_io	qubes-os	c++	heuristic 3	coverage link
fuzz_main	qubes-os	c++	heuristic 3	coverage link
select_loop	qubes-os	c++	heuristic 3	coverage link
handshake_and_go	qubes-os	c++	heuristic 3	coverage link
blosc_decompress	c-blosc	c++	heuristic 3	coverage link
ZSTD_endStream	c-blosc	c++	heuristic 3	coverage link
ZSTD_compressStream	c-blosc	c++	heuristic 3	coverage link
ZSTD_decompressStream	c-blosc	c++	heuristic 3	coverage link
ZSTD_compressBegin_usingCDict_deprecated	c-blosc	c++	heuristic 3	coverage link
LLVMFuzzerInitialize	yara	c	heuristic 3	coverage link
yr_lex_parse_rules_fd	yara	c++	heuristic 3	coverage link
yr_lex_parse_rules_file	yara	c++	heuristic 3	coverage link
yr_lex_parse_rules_bytes	yara	c++	heuristic 3	coverage link
yr_scanner_scan_file	yara	c++	heuristic 3	coverage link
TunnelIPv6Interface::on_link_state_changed(bool,bool)	wpantund	c++	heuristic 3	coverage link
boost::signals2::signal<void(nl::wpantund::WPAN::NetworkInstanceconst&),boost::signals2::optional_last_value<void>,int,std::__1::less<int>,boost::function<void(nl::wpantund::WPAN::NetworkInstanceconst&)>,boost::function<void(boost::signals2::connectionconst&,nl::wpantund::WPAN::NetworkInstanceconst&)>,boost::signals2::mutex>::operator()(nl::wpantund::WPAN::NetworkInstanceconst&)	wpantund	c++	heuristic 3	coverage link
__XX_main(int,char**)	wpantund	c++	heuristic 3	coverage link
TunnelIPv6Interface::on_address_added(in6_addrconst&,unsignedchar)	wpantund	c++	heuristic 3	coverage link
TunnelIPv6Interface::on_address_removed(in6_addrconst&,unsignedchar)	wpantund	c++	heuristic 3	coverage link
data_func(_ExifContent,void)	libexif	c++	heuristic 3	coverage link
exif_content_dump	libexif	c++	heuristic 3	coverage link
exif_entry_dump	libexif	c++	heuristic 3	coverage link
S2Polygon::GetOverlapFractions(S2Polygonconst&,S2Polygonconst&)	s2geometry	c++	heuristic 3	coverage link
S2Polygon::InitToIntersection(S2Polygonconst&,S2Polygonconst&)	s2geometry	c++	heuristic 3	coverage link
S2Polygon::SubtractFromPolyline(S2Polylineconst&)const	s2geometry	c++	heuristic 3	coverage link
S2Polygon::IntersectWithPolyline(S2Polylineconst&)const	s2geometry	c++	heuristic 3	coverage link
S2Polygon::InitToSymmetricDifference(S2Polygonconst&,S2Polygonconst&)	s2geometry	c++	heuristic 3	coverage link
ZSTD_flushStream	zstd	c++	heuristic 3	coverage link
ZSTD_compressBegin	zstd	c++	heuristic 3	coverage link
ZSTD_compressBegin_usingCDict	zstd	c++	heuristic 3	coverage link
ZSTD_createCDict_byReference	zstd	c++	heuristic 3	coverage link
ZSTD_createCDict	zstd	c++	heuristic 3	coverage link
test_jq_start_resets_state	jq	c	heuristic 3	coverage link
jq_compile	jq	c	heuristic 3	coverage link
load_program	jq	c	heuristic 3	coverage link
load_module_meta	jq	c	heuristic 3	coverage link
constant_fold	jq	c	heuristic 3	coverage link
Alembic::AbcCoreOgawa::v12::AprImpl::getSample(long,std::__1::shared_ptr<Alembic::AbcCoreAbstract::v12::ArraySample>&)	alembic	c++	heuristic 3	coverage link
Alembic::AbcGeom::v12::ISubDSchema::getFaceSetNames(std::__1::vector<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::allocator<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>>&)	alembic	c++	heuristic 3	coverage link
Alembic::AbcCoreFactory::v12::IFactory::getArchive(std::__1::vector<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::allocator<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>>const&)	alembic	c++	heuristic 3	coverage link
Alembic::AbcCoreOgawa::v12::ApwImpl::setSample(Alembic::AbcCoreAbstract::v12::ArraySampleconst&)	alembic	c++	heuristic 3	coverage link
Alembic::AbcMaterial::v12::IMaterialSchema::NetworkNode::getTarget(std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>&)	alembic	c++	heuristic 3	coverage link
main2	haproxy	c++	heuristic 3	coverage link
process_stream	haproxy	c++	heuristic 3	coverage link
process_chk	haproxy	c++	heuristic 3	coverage link
process_chk_conn	haproxy	c++	heuristic 3	coverage link
srv_chk_io_cb	haproxy	c++	heuristic 3	coverage link
nlstdir	proftpd	c	heuristic 3	coverage link
log_sess_reinit_ev	proftpd	c	heuristic 3	coverage link
core_chdir	proftpd	c	heuristic 3	coverage link
nlstfile	proftpd	c	heuristic 3	coverage link
sendline	proftpd	c	heuristic 3	coverage link
OQS_KEM_classic_mceliece_6960119f_keypair	liboqs	c	heuristic 3	coverage link
OQS_KEM_classic_mceliece_8192128f_keypair	liboqs	c	heuristic 3	coverage link
PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair	liboqs	c	heuristic 3	coverage link
PQCLEAN_FALCON1024_CLEAN_crypto_sign_keypair	liboqs	c	heuristic 3	coverage link
PQCLEAN_FALCONPADDED512_CLEAN_crypto_sign_keypair	liboqs	c	heuristic 3	coverage link
crow::HTTPParser<crow::Connection<crow::SocketAdaptor,crow::Crow<>>>::on_url(crow::http_parser,charconst,unsignedlong)	crow	c++	heuristic 3	coverage link
crow::HTTPParser<crow::Connection<crow::UnixSocketAdaptor,crow::Crow<>>>::on_url(crow::http_parser,charconst,unsignedlong)	crow	c++	heuristic 3	coverage link
crow::Server<crow::Crow<>,crow::UnixSocketAcceptor,crow::UnixSocketAdaptor>::do_accept()::{lambda(std::__1::error_code)#1}::operator()(std::__1::error_code)const	crow	c++	heuristic 3	coverage link
voidasio::detail::handler_work<crow::Server<crow::Crow<>,crow::UnixSocketAcceptor,crow::UnixSocketAdaptor>::do_accept()::{lambda(std::__1::error_code)#1},asio::system_executor>::complete<asio::detail::binder1<{lambda(std::__1::error_code)#1},std::__1::error_code>>(asio::detail::binder1<{lambda(std::__1::error_code)#1},std::__1::error_code>&,{lambda(std::__1::error_code)#1}&)	crow	c++	heuristic 3	coverage link
voidasio_handler_invoke_helpers::invoke<asio::detail::binder1<crow::Server<crow::Crow<>,crow::UnixSocketAcceptor,crow::UnixSocketAdaptor>::do_accept()::{lambda(std::__1::error_code)#1},std::__1::error_code>,{lambda(std::__1::error_code)#1}>(asio::detail::binder1<crow::Server<crow::Crow<>,crow::UnixSocketAcceptor,crow::UnixSocketAdaptor>::do_accept()::{lambda(std::__1::error_code)#1},std::__1::error_code>&,{lambda(std::__1::error_code)#1}&)	crow	c++	heuristic 3	coverage link
gen_gateway	libpcap	c++	heuristic 3	coverage link
gen_geneve4	libpcap	c++	heuristic 3	coverage link
gen_geneve	libpcap	c++	heuristic 3	coverage link
gen_multicast	libpcap	c++	heuristic 3	coverage link
gen_broadcast	libpcap	c++	heuristic 3	coverage link
LLVMFuzzerInitialize	civetweb	c	heuristic 3	coverage link
mg_send_mime_file	civetweb	c	heuristic 3	coverage link
mg_send_file	civetweb	c	heuristic 3	coverage link
mg_send_file_body	civetweb	c	heuristic 3	coverage link
put_file	civetweb	c	heuristic 3	coverage link
aot_compile_func	wamr	c	heuristic 3	coverage link
wasm_module_new_ex	wamr	c	heuristic 3	coverage link
wasm_loader_load_from_sections	wamr	c	heuristic 3	coverage link
aot_create_comp_context	wamr	c	heuristic 3	coverage link
aot_compile_op_f64_promote_f32	wamr	c	heuristic 3	coverage link
_ULx86_64_dwarf_apply_reg_state	libunwind	c	heuristic 3	coverage link
_ULx86_64_dwarf_reg_states_iterate	libunwind	c	heuristic 3	coverage link
_ULx86_64_local_resume	libunwind	c	heuristic 3	coverage link
op_alias_dialog	neomutt	c++	heuristic 3	coverage link
alias_dialog	neomutt	c++	heuristic 3	coverage link
op_followup	neomutt	c++	heuristic 3	coverage link
op_forward_to_group	neomutt	c++	heuristic 3	coverage link
mutt_send_list_subscribe	neomutt	c++	heuristic 3	coverage link
OpenBabel::VASPFormat::ReadMolecule(OpenBabel::OBBase,OpenBabel::OBConversion)	openbabel	c++	heuristic 3	coverage link
OpenBabel::AliasData::FromNameLookup(OpenBabel::OBMol&,unsignedint)	openbabel	c++	heuristic 3	coverage link
OpenBabel::mmCIFFormat::ReadMolecule(OpenBabel::OBBase,OpenBabel::OBConversion)	openbabel	c++	heuristic 3	coverage link
OpenBabel::OBForceField::SystematicRotorSearch(unsignedint,bool)	openbabel	c++	heuristic 3	coverage link
OpenBabel::OBForceField::SystematicRotorSearchInitialize(unsignedint,bool)	openbabel	c++	heuristic 3	coverage link
Terminal::Complete::init_diff[abi:cxx11]()const	mosh	c++	heuristic 3	coverage link
Terminal::Complete::diff_from[abi:cxx11](Terminal::Completeconst&)const	mosh	c++	heuristic 3	coverage link
Terminal::Framebuffer::resize(int,int)	mosh	c++	heuristic 3	coverage link
CSI_DL(Terminal::Framebuffer,Terminal::Dispatcher)	mosh	c++	heuristic 3	coverage link
CSI_IL(Terminal::Framebuffer,Terminal::Dispatcher)	mosh	c++	heuristic 3	coverage link
njs_parser_export	njs	c++	heuristic 3	coverage link
njs_module_loader	njs	c++	heuristic 3	coverage link
njs_parser_import	njs	c++	heuristic 3	coverage link
njs_engine_njs_output	njs	c++	heuristic 3	coverage link
njs_parser_computed_property_async_after	njs	c++	heuristic 3	coverage link
mbedtls_test_get_tls13_ticket	openthread	c++	heuristic 3	coverage link
exchange_data	openthread	c++	heuristic 3	coverage link
write_ssl_and_get_response	openthread	c++	heuristic 3	coverage link
mbedtls_ssl_read	openthread	c++	heuristic 3	coverage link
mbedtls_ssl_write	openthread	c++	heuristic 3	coverage link
HttpTransact::build_response_from_cache	trafficserver	c++	heuristic 3	coverage link
HttpSM::state_http_server_open	trafficserver	c++	heuristic 3	coverage link
GeneratorInterceptHook	trafficserver	c++	heuristic 3	coverage link
handleServerEvent	trafficserver	c++	heuristic 3	coverage link
fetch_consume	trafficserver	c++	heuristic 3	coverage link
spectre_document_load	libspectre	c++	heuristic 3	coverage link
spectre_document_load_from_stream	libspectre	c++	heuristic 3	coverage link
param_test	libspectre	c++	heuristic 3	coverage link
test_page_size	libspectre	c++	heuristic 3	coverage link
test_document_render	libspectre	c++	heuristic 3	coverage link
sf_open	libsndfile	c	heuristic 3	coverage link
psf_calc_max_all_channels	libsndfile	c	heuristic 3	coverage link
psf_calc_signal_max	libsndfile	c	heuristic 3	coverage link
gsm610_encode_block	libsndfile	c	heuristic 3	coverage link
gsm610_wav_encode_block	libsndfile	c	heuristic 3	coverage link
ha_innobase::commit_inplace_alter_table	mariadb	c++	heuristic 3	coverage link
utf8_normalize	mariadb	c++	heuristic 3	coverage link
normalize_utf8	mariadb	c++	heuristic 3	coverage link
grn_nfkc_compose	mariadb	c++	heuristic 3	coverage link
i_s_fts_being_deleted_fill	mariadb	c++	heuristic 3	coverage link

Heuristics

Heuristic 1

This is the heuristic highlights functions that has all of the following attributes:

- Has "parse" in its function name.
- Has zero percentage code coverage.
- Has accumulated cyclomatic complexity larger than 200.
- Is in a project written in C or C++.

Heuristic 2

This is the heuristic highlights functions that has all of the following attributes:

- Has two arguments.
- First argument has type "char *".
- Second argument has type "int".
- Has accumulated cyclomatic complexity larger than 150