Target oracle

This page shows functions across the entire OSS-Fuzz database that are determined to be likely interesting targets. This suggestion comes from various heuristics that often encapsulate functions that are likely good to fuzz or are, perhaps, easy to fuzz. For each suggestion a justification is included as to why this target is interesting, by way of referencing a given heuristic.

Function name	Project	Language	Reason	Coverage link
tidyParseSource	tidy-html5	c++	heuristic 3	coverage link
AccessibilityCheckNode	tidy-html5	c++	heuristic 3	coverage link
tidySaveSink	tidy-html5	c++	heuristic 3	coverage link
tidyDocSaveString	tidy-html5	c++	heuristic 3	coverage link
tidySaveString	tidy-html5	c++	heuristic 3	coverage link
BZ2_bzCompress	bzip2	c++	heuristic 3	coverage link
BZ2_bzwrite	bzip2	c++	heuristic 3	coverage link
BZ2_bzread	bzip2	c++	heuristic 3	coverage link
BZ2_compressBlock	bzip2	c++	heuristic 3	coverage link
fuzzer_write_data	bzip2	c++	heuristic 3	coverage link
UpnpInit2	pupnp	c	heuristic 3	coverage link
StartMiniServer	pupnp	c	heuristic 3	coverage link
SoapGetServiceVarStatus	pupnp	c	heuristic 3	coverage link
soap_device_callback	pupnp	c	heuristic 3	coverage link
UpnpRenewSubscription	pupnp	c	heuristic 3	coverage link
lxcapi_startl	lxc	c	heuristic 3	coverage link
lxcapi_start	lxc	c	heuristic 3	coverage link
do_lxcapi_restore	lxc	c	heuristic 3	coverage link
__criu_restore	lxc	c	heuristic 3	coverage link
lxc_ls_main	lxc	c	heuristic 3	coverage link
create_thread	lwan	c++	heuristic 3	coverage link
fastcgi_handle_request	lwan	c++	heuristic 3	coverage link
setup_from_config	lwan	c++	heuristic 3	coverage link
try_setup_from_config	lwan	c++	heuristic 3	coverage link
lwan_init_with_config	lwan	c++	heuristic 3	coverage link
main_ni	libyang	c	heuristic 3	coverage link
cmd_print_exec	libyang	c	heuristic 3	coverage link
pt_print_trees	libyang	c	heuristic 3	coverage link
main	libyang	c	heuristic 3	coverage link
pt_create_mount_point	libyang	c	heuristic 3	coverage link
client_callback	cups-filters	c++	heuristic 3	coverage link
browse_poll_get_printers	cups-filters	c++	heuristic 3	coverage link
TextMain	cups-filters	c++	heuristic 3	coverage link
browsepoll_printer_keepalive	cups-filters	c++	heuristic 3	coverage link
find_previous_queue	cups-filters	c++	heuristic 3	coverage link
PngMutator::PngMutator(std::__1::basic_istream<char,std::__1::char_traits<char>>&)	libspng	c++	heuristic 3	coverage link
spng_decoded_image_size	libspng	c++	heuristic 3	coverage link
spng_set_trns	libspng	c++	heuristic 3	coverage link
spng_set_unknown_chunks	libspng	c++	heuristic 3	coverage link
spng_set_gama_int	libspng	c++	heuristic 3	coverage link
reencrypt	cryptsetup	c	heuristic 3	coverage link
luksFormat	cryptsetup	c	heuristic 3	coverage link
reencrypt_luks2_init	cryptsetup	c	heuristic 3	coverage link
activate_and_check_status	cryptsetup	c	heuristic 3	coverage link
reencrypt_luks2_load	cryptsetup	c	heuristic 3	coverage link
fuzz	wuffs	c++	heuristic 3	coverage link
wuffs_base__parse_number_f64	wuffs	c++	heuristic 3	coverage link
fuzz(wuffs_base__io_buffer__struct*,unsignedlong)	wuffs	c++	heuristic 3	coverage link
fuzz_cpp(unsignedcharconst*,unsignedlong,unsignedlong)	wuffs	c++	heuristic 3	coverage link
fuzz_complex(wuffs_base__io_buffer__struct*,unsignedlong)	wuffs	c++	heuristic 3	coverage link
libssh2_scp_recv	libssh2	c++	heuristic 3	coverage link
libssh2_scp_recv2	libssh2	c++	heuristic 3	coverage link
kex_method_mlkem768x25519_key_exchange	libssh2	c++	heuristic 3	coverage link
libssh2_publickey_list_fetch	libssh2	c++	heuristic 3	coverage link
libssh2_sftp_fstat_ex	libssh2	c++	heuristic 3	coverage link
voidboost::container::dtl::flat_tree<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>,boost::container::dtl::select1st<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>,std::__1::less<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>,boost::container::new_allocator<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>>>::insert_equal<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const>(boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const,boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const*)	dbus-sensors	c++	heuristic 3	coverage link
thresholds::checkThresholdsPowerDelay(std::__1::weak_ptr<Sensor>const&,thresholds::ThresholdTimer&)	dbus-sensors	c++	heuristic 3	coverage link
voidboost::container::dtl::flat_tree<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>,boost::container::dtl::select1st<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>,std::__1::less<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>>,boost::container::new_allocator<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>>>::insert_unique<boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const>(boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const,boost::container::dtl::pair<std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char>>,std::__1::vector<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>,std::__1::allocator<std::__1::tuple<charconst,thresholds::Level,thresholds::Direction,double>>>>const*)	dbus-sensors	c++	heuristic 3	coverage link
_ZN5boost4asio20basic_waitable_timerINSt3__16chrono12steady_clockENS0_11wait_traitsIS4_EENS0_15any_io_executorEE10async_waitITkNS0_20completion_token_forIFvNS_6system10error_codeEEEEZN10thresholds14ThresholdTimer10startTimerERKNS2_8weak_ptrI6SensorEERKNSE_9ThresholdEbdE3$_0EEDaOT_	dbus-sensors	c++	heuristic 3	coverage link
_ZN5boost4asio14async_initiateIZZL14getPowerStatusRKNSt3__110shared_ptrIN9sdbusplus4asio10connectionEEEmENK3$_0clENS_6system10error_codeERKNS2_7variantIJNS2_12basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEEEEEUlSC_E_TpTkNS0_20completion_signatureEJFvSC_EENS0_20basic_waitable_timerINS2_6chrono12steady_clockENS0_11wait_traitsISR_EENS0_15any_io_executorEE19initiate_async_waitEJEEENS0_10constraintIXsr6detail31async_result_has_initiate_memfnIT_DpT0_EE5valueEDTclsr12async_resultINS2_5decayISY_E4typeES10_EE8initiatecl7declvalIOT1_EEcl7declvalIOSY_EEspcl7declvalIOT2_EEEEE4typeES15_RSY_DpS18_	dbus-sensors	c++	heuristic 3	coverage link
_zip_checkcons	libzip	c++	heuristic 3	coverage link
zip_unchange	libzip	c++	heuristic 3	coverage link
addr_debug_print	coturn	c	heuristic 3	coverage link
httpmirror	httrack	c	heuristic 3	coverage link
htsparse	httrack	c	heuristic 3	coverage link
sitemap_seed_any	httrack	c	heuristic 3	coverage link
hts_mirror_check_moved	httrack	c	heuristic 3	coverage link
singlefile_rewrite_file	httrack	c	heuristic 3	coverage link
ext2fs_expand_dir	e2fsprogs	c	heuristic 3	coverage link
ext2fs_inline_data_init	e2fsprogs	c	heuristic 3	coverage link
ext2fs_add_journal_inode	e2fsprogs	c	heuristic 3	coverage link
ext2fs_inline_data_expand	e2fsprogs	c	heuristic 3	coverage link
ext2fs_file_set_size	e2fsprogs	c	heuristic 3	coverage link
mrb_load_detect_file_cxt	h2o	c++	heuristic 3	coverage link
http_request_method	h2o	c++	heuristic 3	coverage link
h2o_accept	h2o	c++	heuristic 3	coverage link
h2o_socket_ssl_resume_server_handshake	h2o	c++	heuristic 3	coverage link
proceed_handshake	h2o	c++	heuristic 3	coverage link
Codec::createCodec(FuzzedDataProvider&)	libhevc	c++	heuristic 3	coverage link
Codec::setArchitecture(IV_ARCH_T)	libhevc	c++	heuristic 3	coverage link
Codec::setCores(FuzzedDataProvider&)	libhevc	c++	heuristic 3	coverage link
Codec::decodeHeader(unsignedcharconst*,unsignedlong)	libhevc	c++	heuristic 3	coverage link
Codec::setParams(IVD_VIDEO_DECODE_MODE_T)	libhevc	c++	heuristic 3	coverage link
pugi::xml_node::select_single_node(pugi::xpath_queryconst&)const	pugixml	c++	heuristic 3	coverage link
pugi::xml_node::select_single_node(charconst,pugi::xpath_variable_set)const	pugixml	c++	heuristic 3	coverage link
pugi::xml_node::select_nodes(pugi::xpath_queryconst&)const	pugixml	c++	heuristic 3	coverage link
pugi::xml_node::select_node(pugi::xpath_queryconst&)const	pugixml	c++	heuristic 3	coverage link
pugi::xml_node::select_node(charconst,pugi::xpath_variable_set)const	pugixml	c++	heuristic 3	coverage link
main_to_fuzz	flac	c++	heuristic 3	coverage link
FLAC::Decoder::File::init_ogg(charconst*)	flac	c++	heuristic 3	coverage link
FLAC::Decoder::File::init(charconst*)	flac	c++	heuristic 3	coverage link
FLAC::Decoder::File::init(_IO_FILE*)	flac	c++	heuristic 3	coverage link
FLAC__metadata_chain_read_with_callbacks	flac	c++	heuristic 3	coverage link
SOPC_CommonHelper_Initialize	s2opc	c++	heuristic 3	coverage link
io_dispatch_mgr__client_reactivate_session_new_user	s2opc	c++	heuristic 3	coverage link
exercise_signature_key	s2opc	c++	heuristic 3	coverage link
psa_key_derivation_output_key	s2opc	c++	heuristic 3	coverage link
exercise_asymmetric_encryption_key	s2opc	c++	heuristic 3	coverage link
gps_sock_mainloop	gpsd	c	heuristic 3	coverage link
gps_sock_read	gpsd	c	heuristic 3	coverage link
ntrip_open	gpsd	c	heuristic 3	coverage link
gps_mainloop	gpsd	c	heuristic 3	coverage link
gps_read	gpsd	c	heuristic 3	coverage link
htp_connp_req_close	libhtp	c	heuristic 3	coverage link
htp_process_request_header_apache_2_2	libhtp	c	heuristic 3	coverage link
htp_tx_res_process_body_data	libhtp	c	heuristic 3	coverage link
htp_tx_req_process_body_data	libhtp	c	heuristic 3	coverage link
dispatch_line_d	tinyobjloader	c++	heuristic 3	coverage link
tinyobj::opt_internal::opt_tryParseFloatToken(float,charconst*)	tinyobjloader	c++	heuristic 3	coverage link
fast_float::from_chars_result_t<char>fast_float::from_chars_advanced<float,char>(fast_float::parsed_number_string_t<char>&,float&)	tinyobjloader	c++	heuristic 3	coverage link
handle_f_d	tinyobjloader	c++	heuristic 3	coverage link
handle_mtllib_f	tinyobjloader	c++	heuristic 3	coverage link
resip::Transport::basicCheck(resip::SipMessageconst&)	resiprocate	c++	heuristic 3	coverage link
resip::Helper::make405(resip::SipMessageconst&,intconst*,int)	resiprocate	c++	heuristic 3	coverage link
resip::Helper::makeFailureAck(resip::SipMessageconst&,resip::SipMessageconst&)	resiprocate	c++	heuristic 3	coverage link
resip::SipMessage::releaseContents()	resiprocate	c++	heuristic 3	coverage link
resip::Transport::make100(resip::SipMessage&)	resiprocate	c++	heuristic 3	coverage link
oidc_check_mixed_userid_oauth	mod-auth-openidc	c	heuristic 3	coverage link
oidc_authz_24_checker_claim	mod-auth-openidc	c	heuristic 3	coverage link
oidc_authz_24_checker_claims_expr	mod-auth-openidc	c	heuristic 3	coverage link
oidc_proto_userinfo_request_composite_claims	mod-auth-openidc	c	heuristic 3	coverage link
_decrypt_oversized_aes_kw_ek	mod-auth-openidc	c	heuristic 3	coverage link
yajl_parse	yajl-ruby	c++	heuristic 3	coverage link
yajl_do_parse	yajl-ruby	c++	heuristic 3	coverage link
test_oneliner_with_config	cyclonedds	c	heuristic 3	coverage link
do_test_key_write_xcdrv	cyclonedds	c	heuristic 3	coverage link
do_readtake_sample_rank	cyclonedds	c	heuristic 3	coverage link
ddsc_peek_setup	cyclonedds	c	heuristic 3	coverage link
prepare_dds	cyclonedds	c	heuristic 3	coverage link
skcms_ApproximatelyEqualProfiles	skcms	c++	heuristic 3	coverage link
pybind11::detail::deregister_instance(pybind11::detail::instance,void,pybind11::detail::type_infoconst*)	pybind11	c++	heuristic 3	coverage link
pybind11_meta_call	pybind11	c++	heuristic 3	coverage link
pybind11::detail::values_and_holders::values_and_holders(_object*)	pybind11	c++	heuristic 3	coverage link
pybind11::detail::function_record_PyTypeObject_methods::reduce_ex_impl(_object,_object,_object*)	pybind11	c++	heuristic 3	coverage link
pybind11_object_new	pybind11	c++	heuristic 3	coverage link
subscribe_cb	hiredis	c	heuristic 3	coverage link
subscribe_with_timeout_cb	hiredis	c	heuristic 3	coverage link
subscribe_channel_a_cb	hiredis	c	heuristic 3	coverage link
monitor_cb	hiredis	c	heuristic 3	coverage link
do_aconnect	hiredis	c	heuristic 3	coverage link
H5D__virtual_write	hdf5	c	heuristic 3	coverage link
H5D__virtual_read	hdf5	c	heuristic 3	coverage link
H5D__virtual_read_one_mapping	hdf5	c	heuristic 3	coverage link
H5D__scatgath_read	hdf5	c	heuristic 3	coverage link
H5D__scatgath_write	hdf5	c	heuristic 3	coverage link
rops_handle_POLLIN_h1	libwebsockets	c	heuristic 3	coverage link
rops_handle_POLLIN_ws	libwebsockets	c	heuristic 3	coverage link
rops_handle_POLLIN_listen	libwebsockets	c	heuristic 3	coverage link
lws_ss_adopt_raw	libwebsockets	c	heuristic 3	coverage link
lws_read_h1	libwebsockets	c	heuristic 3	coverage link
fuzz_main	qubes-os	c++	heuristic 3	coverage link
load_service_config	qubes-os	c++	heuristic 3	coverage link
qrexec_process_io	qubes-os	c++	heuristic 3	coverage link
select_loop	qubes-os	c++	heuristic 3	coverage link
handshake_and_go	qubes-os	c++	heuristic 3	coverage link

Heuristics

Heuristic 1

This is the heuristic highlights functions that has all of the following attributes:

- Has "parse" in its function name.
- Has zero percentage code coverage.
- Has accumulated cyclomatic complexity larger than 200.
- Is in a project written in C or C++.

Heuristic 2

This is the heuristic highlights functions that has all of the following attributes:

- Has two arguments.
- First argument has type "char *".
- Second argument has type "int".
- Has accumulated cyclomatic complexity larger than 150