Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzer details

Fuzzer: parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 94 15.2%
gold [1:9] 1 0.16%
yellow [10:29] 4 0.64%
greenyellow [30:49] 3 0.48%
lawngreen 50+ 516 83.4%
All colors 618 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
8 10 3 :

['tl::detail::expected_operations_base ::get() &&', 'void tl::detail::expected_operations_base ::construct (ada::url_aggregator&&)', 'tl::detail::expected_operations_base ::geterr() &']

12 14 voidtl::detail::expected_operations_base ::assign (tl::detail::expected_operations_base &&) call site: 00000 /src/ada-url/build/singleheader/ada.h:2488
2 2 1 :

['tl::detail::expected_operations_base ::geterr() &']

2 4 voidtl::detail::expected_operations_base ::assign_common >(tl::detail::expected_operations_base &&) call site: 00000 /src/ada-url/build/singleheader/ada.h:2544
0 0 None 975 15219 ada::url_aggregatorada::parser::parse_url (std::__1::basic_string_view >,ada::url_aggregatorconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12199
0 0 None 975 15219 ada::url_aggregatorada::parser::parse_url (std::__1::basic_string_view >,ada::url_aggregatorconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12741
0 0 None 291 365 ada::url_aggregator::clear_hostname() call site: 00000 /src/ada-url/build/singleheader/ada.h:6253
0 0 None 282 2932 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12095
0 0 None 282 2932 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12101
0 0 None 282 2932 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12104
0 0 None 274 2924 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12194
0 0 None 274 2924 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12252
0 0 None 274 2924 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12741
0 0 None 274 2924 ada::urlada::parser::parse_url (std::__1::basic_string_view >,ada::urlconst*) call site: 00000 /src/ada-url/build/singleheader/ada.cpp:12787

Runtime coverage analysis

Covered functions
293
Functions that are reachable but not covered
102
Reachable functions
510
Percentage of reachable functions covered
80.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/ada-url/fuzz/parse.cc 1
/src/ada-url/build/singleheader/ada.cpp 96
/src/ada-url/build/singleheader/ada.h 95
/usr/local/bin/../include/c++/v1/optional 10

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
ada::url::get_origin()const /src/ada-url/build/singleheader/ada.cpp 2 ['class.std::__1::basic_string.6 *', 'struct.ada::url *'] 10 0 183 36 33 182 0 1579 68
ada::url_aggregator::set_scheme_from_view_with_colon(std::__1::basic_string_view >) /src/ada-url/build/singleheader/ada.cpp 3 ['struct.ada::url_aggregator *', 'char *', 'size_t '] 4 0 299 70 48 13 0 129 48
ada::url_aggregator::set_scheme(std::__1::basic_string_view >) /src/ada-url/build/singleheader/ada.cpp 3 ['struct.ada::url_aggregator *', 'char *', 'size_t '] 4 0 345 71 47 21 0 144 47
ada::url_aggregator::get_origin()const /src/ada-url/build/singleheader/ada.cpp 2 ['class.std::__1::basic_string.6 *', 'struct.ada::url_aggregator *'] 10 0 253 37 33 213 0 1995 45
ada::url_aggregator::to_string()const /src/ada-url/build/singleheader/ada.cpp 2 ['class.std::__1::basic_string.6 *', 'struct.ada::url_aggregator *'] 2 0 613 90 35 25 0 148 44
ada::url_aggregator::parse_ipv6(std::__1::basic_string_view >) /src/ada-url/build/singleheader/ada.cpp 3 ['struct.ada::url_aggregator *', 'char *', 'size_t '] 4 0 777 140 42 37 0 205 42
ada_parse_with_base /src/ada-url/build/singleheader/ada.cpp 4 ['char *', 'size_t ', 'char *', 'size_t '] 5 0 93 13 9 241 0 2002 42
ada::url::to_string()const /src/ada-url/build/singleheader/ada.cpp 2 ['class.std::__1::basic_string.6 *', 'struct.ada::url *'] 3 0 449 65 37 24 0 92 37

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
67.0%
267 / 400
Cyclomatic complexity statically reachable by fuzzers
88.0%
6465 / 7320

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity