High level conclusions

Fuzzers reach 68.21% code coverage.

Fuzzer TimeBasedRollingPolicyFuzzer-utf-8 is blocked:

The runtime code coverage of TimeBasedRollingPolicyFuzzer-utf-8 covers 11.86% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer HTMLLayoutFuzzer-utf-8 is blocked:

The runtime code coverage of HTMLLayoutFuzzer-utf-8 covers 10.78% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer XMLLayoutFuzzer-utf-8 is blocked:

The runtime code coverage of XMLLayoutFuzzer-utf-8 covers 9.876% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 29.58% of cyclomatic complexity.

Fuzzers reach 15.57% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

771 / 4949

Cyclomatic complexity statically reachable by fuzzers

7714 / 26073

Runtime code coverage of functions

3376 / 4949

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: JSONLayoutFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8	9.09%
gold	[1:9]	2	2.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	78	88.6%
All colors	88	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	1	LLVMFuzzerTestOneInput	call site: 00001
2	72	log4cxx::Layout::format(std::__1::basic_string , std::__1::allocator >&, std::__1::shared_ptr const&) const	call site: 00072	apr_pool_destroy
1	11	log4cxx::helpers::OptionConverter::toBoolean(std::__1::basic_string , std::__1::allocator > const&, bool)	call site: 00011
1	39	log4cxx::helpers::WideLife >::~WideLife()	call site: 00039	__cxa_begin_catch
1	57	LLVMFuzzerTestOneInput	call site: 00057

Runtime coverage analysis

Covered functions

835

Functions that are reachable but not covered

10

Reachable functions

83

Percentage of reachable functions covered

87.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/JSONLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	2
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	1
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	4
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3
/src/logging-log4cxx/src/main/cpp/pool.cpp	2

Fuzzer: PatternConverterFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	29.2%
gold	[1:9]	63	18.8%
yellow	[10:29]	44	13.1%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	130	38.8%
All colors	335	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	110	log4cxx::helpers::Pool::setPool()	call site: 00110	__cxa_allocate_exception
14	172	unsigned int decodeCodePoint (std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >::const_iterator&)	call site: 00172	fputws
4	30	LLVMFuzzerTestOneInput	call site: 00030
4	72	log4cxx::helpers::Exception::Exception(std::__1::basic_string , std::__1::allocator > const&)	call site: 00072	__cxa_throw
4	204	LLVMFuzzerTestOneInput	call site: 00204
3	65	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00065	__cxa_allocate_exception
3	168	isConsoleWide(_IO_FILE*)	call site: 00168
3	319	LLVMFuzzerTestOneInput	call site: 00319
3	331	LLVMFuzzerTestOneInput	call site: 00331
2	162	log4cxx::helpers::LogLog::emit_log(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00162
2	222	log4cxx::pattern::DatePatternConverter::getDateFormat(std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)	call site: 00222	__cxa_end_catch
2	279	LLVMFuzzerTestOneInput	call site: 00279

Runtime coverage analysis

Covered functions

982

Functions that are reachable but not covered

91

Reachable functions

290

Percentage of reachable functions covered

68.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternConverterFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	7
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	24
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/propertiespatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/cpp/loggingeventpatternconverter.cpp	3
/src/logging-log4cxx/src/main/cpp/patternconverter.cpp	3
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/pattern/propertiespatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggingeventpatternconverter.h	1
/src/logging-log4cxx/src/main/cpp/loggerpatternconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/namepatternconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/nameabbreviator.cpp	3
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	4
/src/logging-log4cxx/src/main/cpp/loglog.cpp	7
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	6
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggerpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/namepatternconverter.h	1
/src/logging-log4cxx/src/main/cpp/classnamepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/classnamepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/datepatternconverter.cpp	4
/src/logging-log4cxx/src/main/cpp/cacheddateformat.cpp	1
/src/logging-log4cxx/src/main/cpp/timezone.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/timezone.h	1
/src/logging-log4cxx/src/main/cpp/fulllocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/fulllocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/linelocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/linelocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/messagepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/messagepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/lineseparatorpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/lineseparatorpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/methodlocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/methodlocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/levelpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/levelpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/relativetimepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/relativetimepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/threadpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/threadusernamepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadusernamepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/ndcpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/ndcpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/throwableinformationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/throwableinformationpatternconverter.h	2

Fuzzer: /src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/DOMConfiguratorFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	66.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	33.3%
All colors	6	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	0	EP	call site: 00000	fopen

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

3

Reachable functions

8

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/DOMConfiguratorFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/xml/domconfigurator.h	1

Fuzzer: DOMConfiguratorFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	558	55.3%
gold	[1:9]	150	14.8%
yellow	[10:29]	1	0.09%
greenyellow	[30:49]	4	0.39%
lawngreen	50+	296	29.3%
All colors	1009	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	930	log4cxx::helpers::WideLife ::operator log4cxx::AsyncAppender::ClazzAsyncAppender&()	call site: 00930	__dynamic_cast
32	892	log4cxx::helpers::WideLife ::operator log4cxx::spi::AppenderAttachable::ClazzAppenderAttachable&()	call site: 00892	__cxa_guard_abort
16	646	log4cxx::xml::DOMConfigurator::DOMConfiguratorPrivate::parseChildrenOfLoggerElement(apr_xml_elem*, std::__1::shared_ptr , bool)	call site: 00646	__cxa_guard_acquire
16	709	log4cxx::config::PropertySetter::activate()	call site: 00709	__cxa_begin_catch
14	71	log4cxx::helpers::Pool::setPool()	call site: 00071	__cxa_allocate_exception
14	675	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00675	__cxa_guard_acquire
14	848	log4cxx::helpers::WideLife ::operator log4cxx::rolling::FilterBasedTriggeringPolicy::ClazzFilterBasedTriggeringPolicy&()	call site: 00848	__cxa_begin_catch
13	758	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00758
12	737	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00737
10	595	log4cxx::helpers::WideLife ::operator log4cxx::spi::LoggerFactory::ClazzLoggerFactory&()	call site: 00595	__cxa_begin_catch
10	606	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00606
9	131	isConsoleWide(_IO_FILE*)	call site: 00131

Runtime coverage analysis

Covered functions

939

Functions that are reachable but not covered

199

Reachable functions

707

Percentage of reachable functions covered

71.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/DOMConfiguratorFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/xml/domconfigurator.h	1
/src/logging-log4cxx/src/main/cpp/domconfigurator.cpp	26
/src/logging-log4cxx/src/main/cpp/file.cpp	7
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	20
/src/logging-log4cxx/src/main/cpp/configurator.cpp	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	2
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	95
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	14
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	7
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	10
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	4
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	2
/src/logging-log4cxx/src/main/cpp/loader.cpp	9
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/class.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/private/string_c11.h	1
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	2
/src/logging-log4cxx/src/main/cpp/properties.cpp	2
/src/logging-log4cxx/src/main/cpp/level.cpp	11
/src/logging-log4cxx/src/main/include/log4cxx/level.h	1
/src/logging-log4cxx/src/main/cpp/asyncappender.cpp	2
/src/logging-log4cxx/src/main/cpp/classregistration.cpp	1
/src/logging-log4cxx/src/main/cpp/consoleappender.cpp	1
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	1
/src/logging-log4cxx/src/main/cpp/odbcappender.cpp	1
/src/logging-log4cxx/src/main/cpp/smtpappender.cpp	3
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/simplelayout.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/levelmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/levelrangefilter.cpp	1
/src/logging-log4cxx/src/main/cpp/stringmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/locationinfofilter.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/cpp/sizebasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/manualtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/fixedwindowrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/filterbasedtriggeringpolicy.cpp	3
/src/logging-log4cxx/src/main/cpp/propertyconfigurator.cpp	1
/src/logging-log4cxx/src/main/cpp/fallbackerrorhandler.cpp	2
/src/logging-log4cxx/src/main/cpp/telnetappender.cpp	1
/src/logging-log4cxx/src/main/cpp/xmlsocketappender.cpp	1
/src/logging-log4cxx/src/main/cpp/syslogappender.cpp	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/loggerfactory.h	1
/src/logging-log4cxx/src/main/cpp/propertysetter.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	1
/src/logging-log4cxx/src/main/include/log4cxx/config/propertysetter.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	4
/src/logging-log4cxx/src/main/cpp/appender.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/filter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/errorhandler.h	1
/src/logging-log4cxx/src/main/cpp/appenderskeleton.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/appenderskeleton.h	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingfileappender.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/filterbasedtriggeringpolicy.h	1
/src/logging-log4cxx/src/main/cpp/filter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/net/smtpappender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/triggeringeventevaluator.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/appenderattachable.h	3
/src/logging-log4cxx/src/main/include/log4cxx/asyncappender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	2
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/spi/configurator.h	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/TimeBasedRollingPolicyFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	23	88.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	11.5%
All colors	26	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	0	EP	call site: 00000
5	20	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00020	remove
4	15	log4cxx::Logger::isDebugEnabledFor(std::__1::shared_ptr const&)	call site: 00015

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

4

Reachable functions

43

Percentage of reachable functions covered

90.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TimeBasedRollingPolicyFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: PatternLayoutFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	535	58.4%
gold	[1:9]	302	33.0%
yellow	[10:29]	16	1.74%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	62	6.77%
All colors	915	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
183	446	log4cxx::helpers::WideLife ::operator log4cxx::helpers::ClassRegistration&()	call site: 00446	_ZN7log4cxx7helpers8WideLifeINS0_17ClassRegistrationEEC2IRFRKNS0_5ClassEvEJEQntsr3stdE7same_asINS1_IT_EETL0__EEEOSA_DpOT0_
17	62	log4cxx::helpers::Pool::setPool()	call site: 00062	__cxa_allocate_exception
17	114	log4cxx::helpers::LogLog::getInstance()	call site: 00114	fwide
16	313	log4cxx::helpers::OptionConverter::substVars(std::__1::basic_string , std::__1::allocator > const&, log4cxx::helpers::Properties&)	call site: 00313	__cxa_allocate_exception
13	81	log4cxx::helpers::Pool::~Pool()	call site: 00081	apr_filepath_get
13	630	log4cxx::PropertyConfigurator::doConfigure(log4cxx::helpers::Properties&, std::__1::shared_ptr )	call site: 00630
12	133	log4cxx::helpers::ByteBufferPriv::increment_position(unsigned long)	call site: 00133	fputws
11	47	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00047	__cxa_allocate_exception
11	247	log4cxx::helpers::Properties::load(std::__1::shared_ptr )	call site: 00247	__cxa_allocate_exception
10	288	log4cxx::PropertyConfigurator::doConfigure(log4cxx::File const&, std::__1::shared_ptr )	call site: 00288	__cxa_end_catch
9	785	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00785	__cxa_guard_acquire
8	653	log4cxx::PropertyConfigurator::parseLogger(log4cxx::helpers::Properties&, std::__1::shared_ptr &, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, bool)	call site: 00653	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1074

Functions that are reachable but not covered

170

Reachable functions

686

Percentage of reachable functions covered

75.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternLayoutFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/configurator.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	3
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	67
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	13
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	9
/src/logging-log4cxx/src/main/cpp/system.cpp	2
/src/logging-log4cxx/src/main/cpp/exception.cpp	12
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	7
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	3
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	14
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	2
/src/logging-log4cxx/src/main/cpp/loader.cpp	5
/src/logging-log4cxx/src/main/cpp/class.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	2
/src/logging-log4cxx/src/main/cpp/properties.cpp	11
/usr/local/bin/../include/c++/v1/sstream	4
/src/logging-log4cxx/src/main/cpp/file.cpp	7
/src/logging-log4cxx/src/main/cpp/propertyconfigurator.cpp	15
/src/logging-log4cxx/src/main/include/log4cxx/defaultloggerfactory.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/loggerfactory.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/configurator.h	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/fileinputstream.cpp	2
/src/logging-log4cxx/src/main/cpp/inputstream.cpp	2
/src/logging-log4cxx/src/main/cpp/inputstreamreader.cpp	2
/src/logging-log4cxx/src/main/cpp/reader.cpp	3
/src/logging-log4cxx/src/main/cpp/level.cpp	11
/src/logging-log4cxx/src/main/include/log4cxx/level.h	1
/src/logging-log4cxx/src/main/cpp/asyncappender.cpp	2
/src/logging-log4cxx/src/main/cpp/classregistration.cpp	1
/src/logging-log4cxx/src/main/cpp/consoleappender.cpp	1
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	1
/src/logging-log4cxx/src/main/cpp/odbcappender.cpp	1
/src/logging-log4cxx/src/main/cpp/smtpappender.cpp	1
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/simplelayout.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/levelmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/levelrangefilter.cpp	1
/src/logging-log4cxx/src/main/cpp/stringmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/locationinfofilter.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/cpp/sizebasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/manualtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/fixedwindowrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/filterbasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/domconfigurator.cpp	1
/src/logging-log4cxx/src/main/cpp/fallbackerrorhandler.cpp	1
/src/logging-log4cxx/src/main/cpp/telnetappender.cpp	1
/src/logging-log4cxx/src/main/cpp/xmlsocketappender.cpp	1
/src/logging-log4cxx/src/main/cpp/syslogappender.cpp	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	4
/src/logging-log4cxx/src/main/cpp/stringtokenizer.cpp	4
/src/logging-log4cxx/src/main/cpp/appender.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/propertysetter.cpp	5
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/config/propertysetter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingfileappender.h	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/asyncappender.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	3
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/spi/appenderattachable.h	2
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/cpp/messagebuffer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1

Fuzzer: /src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/TranscoderFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	19	38.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	30	61.2%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	0	EP	call site: 00000	fprintf
4	27	(anonymous namespace)::exerciseEncoder(std::__1::shared_ptr const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00027	__cxa_begin_catch
3	45	(anonymous namespace)::checkUTF16RoundTrip(unsigned int)	call site: 00045
2	18	(anonymous namespace)::exerciseDecoder(std::__1::shared_ptr const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00018

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

4

Reachable functions

63

Percentage of reachable functions covered

93.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TranscoderFuzzer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/PatternParserFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	11	100.%
All colors	11	100

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

1

Reachable functions

16

Percentage of reachable functions covered

93.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternParserFuzzer.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: XMLLayoutFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	8.92%
gold	[1:9]	14	12.5%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	88	78.5%
All colors	112	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	1	LLVMFuzzerTestOneInput	call site: 00001
2	23	log4cxx::Layout::format(std::__1::basic_string , std::__1::allocator >&, std::__1::shared_ptr const&) const	call site: 00023	apr_pool_destroy
2	44	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00044
1	12	log4cxx::helpers::WideLife >::~WideLife()	call site: 00012	__cxa_begin_catch
1	52	log4cxx::helpers::CharsetDecoder::getDefaultDecoder()	call site: 00052
1	85	LLVMFuzzerTestOneInput	call site: 00085

Runtime coverage analysis

Covered functions

805

Functions that are reachable but not covered

11

Reachable functions

114

Percentage of reachable functions covered

90.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	3
/src/logging-log4cxx/src/main/cpp/level.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	8
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/layout_priv.h	1
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	2
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3

Fuzzer: PatternParserFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	69	32.5%
gold	[1:9]	53	25.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	42.4%
All colors	212	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	105	log4cxx::helpers::Pool::setPool()	call site: 00105	__cxa_allocate_exception
14	169	unsigned int decodeCodePoint (std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >::const_iterator&)	call site: 00169	fputws
13	124	log4cxx::helpers::Pool::~Pool()	call site: 00124	apr_filepath_get
4	24	log4cxx::pattern::PatternParser::parse(std::__1::basic_string , std::__1::allocator > const&, std::__1::map , std::__1::allocator >, std::__1::function (std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)>, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::function (std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)> > > > const&)	call site: 00024	__cxa_guard_acquire
4	67	log4cxx::helpers::Exception::Exception(std::__1::basic_string , std::__1::allocator > const&)	call site: 00067	__cxa_throw
3	60	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00060	__cxa_allocate_exception
3	165	isConsoleWide(_IO_FILE*)	call site: 00165
2	159	log4cxx::helpers::LogLog::emit_log(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00159
1	10	log4cxx::helpers::WideLife >::~WideLife()	call site: 00010	__cxa_begin_catch
1	19	LLVMFuzzerTestOneInput	call site: 00019
1	29	log4cxx::helpers::WideLife >::~WideLife()	call site: 00029	__cxa_guard_release
1	32	log4cxx::helpers::WideLife >::operator std::__1::shared_ptr &()	call site: 00032	__cxa_guard_abort

Runtime coverage analysis

Covered functions

936

Functions that are reachable but not covered

60

Reachable functions

212

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternParserFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	7
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	23
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/cpp/patternparser.cpp	7
/src/logging-log4cxx/src/main/cpp/formattinginfo.cpp	4
/src/logging-log4cxx/src/main/cpp/literalpatternconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/loglog.cpp	6
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	6
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	1
/src/logging-log4cxx/src/main/cpp/patternconverter.cpp	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/HTMLLayoutFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	25	92.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	7.40%
All colors	27	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	0	EP	call site: 00000
10	16	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00016

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

3

Reachable functions

32

Percentage of reachable functions covered

90.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/HTMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: XMLLayoutFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	82	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	82	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	0	EP	call site: 00000	__cxa_guard_acquire

Runtime coverage analysis

Covered functions

696

Functions that are reachable but not covered

73

Reachable functions

81

Percentage of reachable functions covered

9.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	3
/src/logging-log4cxx/src/main/cpp/level.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	4
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/layout_priv.h	1
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	1
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3

Fuzzer: HTMLLayoutFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	94.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	5.50%
All colors	109	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
57	51	log4cxx::HTMLLayout::setOption(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00051	__cxa_guard_acquire
44	0	EP	call site: 00000	__cxa_guard_acquire
2	46	log4cxx::HTMLLayout::setOption(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00046

Runtime coverage analysis

Covered functions

696

Functions that are reachable but not covered

91

Reachable functions

102

Percentage of reachable functions covered

10.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/HTMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/timezone.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	8
/src/logging-log4cxx/src/main/cpp/simpledateformat.cpp	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	4
/src/logging-log4cxx/src/main/cpp/level.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/layout_priv.h	1
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	1
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/PatternLayoutFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	50.0%
gold	[1:9]	7	35.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	15.0%
All colors	20	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	11	log4cxx::Logger::isInfoEnabledFor(std::__1::shared_ptr const&)	call site: 00011
3	16	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00016
2	8	init()	call site: 00008
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

3

Reachable functions

36

Percentage of reachable functions covered

91.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternLayoutFuzzer.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: /src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/cmake/LibFuzzerTest.cpp	1

Fuzzer: PatternParserFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	61	23.6%
gold	[1:9]	77	29.8%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	46.5%
All colors	258	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	168	log4cxx::helpers::Pool::setPool()	call site: 00168	__cxa_allocate_exception
13	187	log4cxx::helpers::Pool::~Pool()	call site: 00187	apr_filepath_get
4	54	log4cxx::pattern::PatternParser::parse(std::__1::basic_string , std::__1::allocator > const&, std::__1::map , std::__1::allocator >, std::__1::function (std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)>, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::function (std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)> > > > const&)	call site: 00054	__cxa_guard_acquire
4	130	log4cxx::helpers::Exception::Exception(std::__1::basic_string , std::__1::allocator > const&)	call site: 00130	__cxa_throw
3	90	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00090	__cxa_allocate_exception
2	6	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00006
2	101	log4cxx::helpers::CharsetEncoder::createDefaultEncoder()	call site: 00101
2	126	log4cxx::helpers::Transcoder::encode(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >&)	call site: 00126
2	222	log4cxx::helpers::LogLog::emit_log(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00222
1	13	log4cxx::helpers::WideLife >::~WideLife()	call site: 00013	__cxa_begin_catch
1	16	log4cxx::helpers::CharsetDecoder::getDefaultDecoder()	call site: 00016
1	49	LLVMFuzzerTestOneInput	call site: 00049

Runtime coverage analysis

Covered functions

973

Functions that are reachable but not covered

42

Reachable functions

260

Percentage of reachable functions covered

83.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternParserFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	31
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	1
/src/logging-log4cxx/src/main/cpp/patternparser.cpp	7
/src/logging-log4cxx/src/main/cpp/formattinginfo.cpp	4
/src/logging-log4cxx/src/main/cpp/literalpatternconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/loglog.cpp	6
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	6
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/cpp/patternconverter.cpp	1

Fuzzer: TimeBasedRollingPolicyFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	200	43.4%
gold	[1:9]	66	14.3%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	194	42.1%
All colors	460	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	386	log4cxx::helpers::WideLife ::operator log4cxx::helpers::Object::ClazzObject&()	call site: 00386	__cxa_guard_abort
30	166	log4cxx::helpers::Pool::setPool()	call site: 00166	__cxa_allocate_exception
10	264	log4cxx::WriterAppender::WriterAppenderPriv::close()	call site: 00264	__cxa_end_catch
9	153	log4cxx::helpers::ByteBuffer::clear()	call site: 00153	__cxa_throw
8	325	log4cxx::FileAppender::setFileInternal(std::__1::basic_string , std::__1::allocator > const&, bool, bool, unsigned long)	call site: 00325
8	360	log4cxx::FileAppender::activateOptionsInternal()	call site: 00360	__cxa_end_catch
7	222	log4cxx::helpers::SystemErrWriter::write(std::__1::basic_string , std::__1::allocator > const&)	call site: 00222	fwide
7	336	log4cxx::File::mkdirs() const	call site: 00336	__cxa_rethrow
6	118	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00118	__cxa_allocate_exception
5	25	LLVMFuzzerTestOneInput	call site: 00025
5	216	log4cxx::helpers::LogLog::getInstance()	call site: 00216
5	353	log4cxx::WriterAppender::WriterAppenderPriv::writeHeader()	call site: 00353	__clang_call_terminate

Runtime coverage analysis

Covered functions

1246

Functions that are reachable but not covered

101

Reachable functions

446

Percentage of reachable functions covered

77.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TimeBasedRollingPolicyFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	5
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/layout.cpp	3
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	2
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	9
/src/logging-log4cxx/src/main/cpp/writerappender.cpp	7
/src/logging-log4cxx/src/main/cpp/appenderskeleton.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	2
/src/logging-log4cxx/src/main/cpp/rollingpolicybase.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	5
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	8
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	27
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	2
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	11
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	4
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/cpp/loader.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/class.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/rolloverdescription.cpp	4
/src/logging-log4cxx/src/main/cpp/action.cpp	1
/src/logging-log4cxx/src/main/cpp/file.cpp	10
/src/logging-log4cxx/src/main/cpp/outputstream.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/private/writerappender_priv.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	12
/src/logging-log4cxx/src/main/include/log4cxx/helpers/threadutility.h	1
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	5
/src/logging-log4cxx/src/main/cpp/messagebuffer.cpp	7
/usr/local/bin/../include/c++/v1/sstream	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	1
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	2
/src/logging-log4cxx/src/main/cpp/appender.cpp	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/JSONLayoutFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	93.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	6.66%
All colors	30	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	0	EP	call site: 00000
10	19	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00019

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

1

Reachable functions

30

Percentage of reachable functions covered

96.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/JSONLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	90.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	9.09%
All colors	22	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	0	EP	call site: 00000
10	11	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00011

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

1

Reachable functions

32

Percentage of reachable functions covered

96.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1

Fuzzer: JSONLayoutFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	9.56%
gold	[1:9]	14	12.1%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	78.2%
All colors	115	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	1	LLVMFuzzerTestOneInput	call site: 00001
2	27	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00027
2	99	log4cxx::Layout::format(std::__1::basic_string , std::__1::allocator >&, std::__1::shared_ptr const&) const	call site: 00099	apr_pool_destroy
1	11	log4cxx::helpers::OptionConverter::toBoolean(std::__1::basic_string , std::__1::allocator > const&, bool)	call site: 00011
1	34	log4cxx::helpers::WideLife >::~WideLife()	call site: 00034	__cxa_begin_catch
1	37	log4cxx::helpers::CharsetDecoder::getDefaultDecoder()	call site: 00037
1	86	LLVMFuzzerTestOneInput	call site: 00086

Runtime coverage analysis

Covered functions

852

Functions that are reachable but not covered

11

Reachable functions

116

Percentage of reachable functions covered

90.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/JSONLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	2
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	2
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	8
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3
/src/logging-log4cxx/src/main/cpp/pool.cpp	2

Fuzzer: PatternConverterFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	90	23.6%
gold	[1:9]	80	20.9%
yellow	[10:29]	26	6.82%
greenyellow	[30:49]	25	6.56%
lawngreen	50+	160	41.9%
All colors	381	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	173	log4cxx::helpers::Pool::setPool()	call site: 00173	__cxa_allocate_exception
4	60	LLVMFuzzerTestOneInput	call site: 00060
4	135	log4cxx::helpers::Exception::Exception(std::__1::basic_string , std::__1::allocator > const&)	call site: 00135	__cxa_throw
4	250	LLVMFuzzerTestOneInput	call site: 00250
3	95	log4cxx::helpers::OptionConverter::getSystemProperty(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00095	__cxa_allocate_exception
3	365	LLVMFuzzerTestOneInput	call site: 00365
3	377	LLVMFuzzerTestOneInput	call site: 00377
2	6	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00006
2	106	log4cxx::helpers::CharsetEncoder::createDefaultEncoder()	call site: 00106
2	131	log4cxx::helpers::Transcoder::encode(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >&)	call site: 00131
2	225	log4cxx::helpers::LogLog::emit_log(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 00225
2	268	log4cxx::pattern::DatePatternConverter::getDateFormat(std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > > const&)	call site: 00268	__cxa_end_catch

Runtime coverage analysis

Covered functions

1021

Functions that are reachable but not covered

73

Reachable functions

338

Percentage of reachable functions covered

78.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternConverterFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	32
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/level.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/propertiespatternconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/loggingeventpatternconverter.cpp	3
/src/logging-log4cxx/src/main/cpp/patternconverter.cpp	3
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/pattern/propertiespatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggingeventpatternconverter.h	1
/src/logging-log4cxx/src/main/cpp/loggerpatternconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/namepatternconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/nameabbreviator.cpp	3
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	4
/src/logging-log4cxx/src/main/cpp/loglog.cpp	7
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	6
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggerpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/namepatternconverter.h	1
/src/logging-log4cxx/src/main/cpp/classnamepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/classnamepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/datepatternconverter.cpp	4
/src/logging-log4cxx/src/main/cpp/cacheddateformat.cpp	1
/src/logging-log4cxx/src/main/cpp/timezone.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/timezone.h	1
/src/logging-log4cxx/src/main/cpp/fulllocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/fulllocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/linelocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/linelocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/messagepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/messagepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/lineseparatorpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/lineseparatorpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/methodlocationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/methodlocationpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/levelpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/levelpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/relativetimepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/relativetimepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/threadpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/threadusernamepatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadusernamepatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/ndcpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/ndcpatternconverter.h	2
/src/logging-log4cxx/src/main/cpp/throwableinformationpatternconverter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/throwableinformationpatternconverter.h	2

Fuzzer: TranscoderFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	4.38%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	109	95.6%
All colors	114	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	22	LLVMFuzzerTestOneInput	call site: 00022	fprintf
1	65	log4cxx::helpers::CharsetEncoder::getEncoder(std::__1::basic_string , std::__1::allocator > const&)	call site: 00065
1	79	LLVMFuzzerTestOneInput	call site: 00079	__cxa_end_catch
1	110	unsigned int decodeCodePoint (std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >::const_iterator&)	call site: 00110

Runtime coverage analysis

Covered functions

796

Functions that are reachable but not covered

4

Reachable functions

105

Percentage of reachable functions covered

96.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TranscoderFuzzer.cpp	7
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	16
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	9
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	2
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	4
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	10
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1

Fuzzer: PatternLayoutFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	542	56.5%
gold	[1:9]	322	33.6%
yellow	[10:29]	16	1.67%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	78	8.14%
All colors	958	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
183	489	log4cxx::helpers::WideLife ::operator log4cxx::helpers::ClassRegistration&()	call site: 00489	_ZN7log4cxx7helpers8WideLifeINS0_17ClassRegistrationEEC2IRFRKNS0_5ClassEvEJEQntsr3stdE7same_asINS1_IT_EETL0__EEEOSA_DpOT0_
16	356	log4cxx::helpers::OptionConverter::substVars(std::__1::basic_string , std::__1::allocator > const&, log4cxx::helpers::Properties&)	call site: 00356	__cxa_allocate_exception
15	76	log4cxx::helpers::ByteBuffer::flip()	call site: 00076	__cxa_throw
14	177	log4cxx::helpers::LogLog::getInstance()	call site: 00177	fwide
13	144	log4cxx::helpers::Pool::~Pool()	call site: 00144	apr_filepath_get
13	673	log4cxx::PropertyConfigurator::doConfigure(log4cxx::helpers::Properties&, std::__1::shared_ptr )	call site: 00673
12	273	log4cxx::helpers::FileInputStream::FileInputStreamPrivate::open()	call site: 00273	__cxa_allocate_exception
11	290	log4cxx::helpers::Properties::load(std::__1::shared_ptr )	call site: 00290	__cxa_allocate_exception
10	331	log4cxx::PropertyConfigurator::doConfigure(log4cxx::File const&, std::__1::shared_ptr )	call site: 00331	__cxa_end_catch
9	133	log4cxx::helpers::Transcoder::decode(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >&)	call site: 00133	__cxa_throw
9	827	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00827	__cxa_guard_acquire
8	95	log4cxx::helpers::Pool::setPool()	call site: 00095	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1093

Functions that are reachable but not covered

179

Reachable functions

740

Percentage of reachable functions covered

75.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternLayoutFuzzer.cpp	2
/src/logging-log4cxx/src/main/cpp/configurator.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	3
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	75
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	13
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	9
/src/logging-log4cxx/src/main/cpp/system.cpp	2
/src/logging-log4cxx/src/main/cpp/exception.cpp	13
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	5
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	14
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	6
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	4
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/cpp/loader.cpp	5
/src/logging-log4cxx/src/main/cpp/class.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	2
/src/logging-log4cxx/src/main/cpp/properties.cpp	11
/usr/local/bin/../include/c++/v1/sstream	4
/src/logging-log4cxx/src/main/cpp/file.cpp	7
/src/logging-log4cxx/src/main/cpp/propertyconfigurator.cpp	15
/src/logging-log4cxx/src/main/include/log4cxx/defaultloggerfactory.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/loggerfactory.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/configurator.h	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/fileinputstream.cpp	2
/src/logging-log4cxx/src/main/cpp/inputstream.cpp	2
/src/logging-log4cxx/src/main/cpp/inputstreamreader.cpp	2
/src/logging-log4cxx/src/main/cpp/reader.cpp	3
/src/logging-log4cxx/src/main/cpp/level.cpp	11
/src/logging-log4cxx/src/main/include/log4cxx/level.h	1
/src/logging-log4cxx/src/main/cpp/asyncappender.cpp	2
/src/logging-log4cxx/src/main/cpp/classregistration.cpp	1
/src/logging-log4cxx/src/main/cpp/consoleappender.cpp	1
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	1
/src/logging-log4cxx/src/main/cpp/odbcappender.cpp	1
/src/logging-log4cxx/src/main/cpp/smtpappender.cpp	1
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/simplelayout.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/levelmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/levelrangefilter.cpp	1
/src/logging-log4cxx/src/main/cpp/stringmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/locationinfofilter.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/cpp/sizebasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/manualtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/fixedwindowrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/filterbasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/domconfigurator.cpp	1
/src/logging-log4cxx/src/main/cpp/fallbackerrorhandler.cpp	1
/src/logging-log4cxx/src/main/cpp/telnetappender.cpp	1
/src/logging-log4cxx/src/main/cpp/xmlsocketappender.cpp	1
/src/logging-log4cxx/src/main/cpp/syslogappender.cpp	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	4
/src/logging-log4cxx/src/main/cpp/stringtokenizer.cpp	4
/src/logging-log4cxx/src/main/cpp/appender.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/propertysetter.cpp	5
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/config/propertysetter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingfileappender.h	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/asyncappender.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	3
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/spi/appenderattachable.h	2
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/cpp/messagebuffer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1

Fuzzer: TimeBasedRollingPolicyFuzzer-utf-8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	397	97.3%
gold	[1:9]	7	1.71%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	0.98%
All colors	408	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
131	196	log4cxx::helpers::WideLife ::operator log4cxx::spi::RepositorySelector::ClazzRepositorySelector&()	call site: 00196	__cxa_guard_abort
72	335	log4cxx::helpers::WideLife ::operator log4cxx::helpers::Object::ClazzObject&()	call site: 00335	__cxa_guard_abort
63	125	log4cxx::helpers::System::getProperty(std::__1::basic_string , std::__1::allocator > const&)	call site: 00125	apr_uid_current
51	0	EP	call site: 00000	apr_pool_destroy
34	86	log4cxx::helpers::WideLife ::WideLife()	call site: 00086	__cxa_allocate_exception
21	64	log4cxx::helpers::WideLife ::WideLife()	call site: 00064	apr_pool_create_ex
11	52	log4cxx::helpers::WideLife<(anonymous namespace)::apr_environment>::WideLife()	call site: 00052	apr_initialize
6	189	log4cxx::helpers::WideLife ::WideLife()	call site: 00189	__cxa_atexit
6	328	log4cxx::helpers::WideLife ::WideLife()	call site: 00328	__cxa_atexit
2	121	log4cxx::helpers::System::getProperty(std::__1::basic_string , std::__1::allocator > const&)	call site: 00121	apr_filepath_get

Runtime coverage analysis

Covered functions

696

Functions that are reachable but not covered

349

Reachable functions

396

Percentage of reachable functions covered

11.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TimeBasedRollingPolicyFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	5
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/layout.cpp	3
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	2
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	9
/src/logging-log4cxx/src/main/cpp/writerappender.cpp	7
/src/logging-log4cxx/src/main/cpp/appenderskeleton.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	2
/src/logging-log4cxx/src/main/cpp/rollingpolicybase.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	5
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	2
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	19
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	11
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	2
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	6
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	2
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	4
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	1
/src/logging-log4cxx/src/main/cpp/loader.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/class.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/rolloverdescription.cpp	4
/src/logging-log4cxx/src/main/cpp/action.cpp	1
/src/logging-log4cxx/src/main/cpp/file.cpp	10
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	2
/src/logging-log4cxx/src/main/cpp/outputstream.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/private/writerappender_priv.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	12
/src/logging-log4cxx/src/main/include/log4cxx/helpers/threadutility.h	1
/src/logging-log4cxx/src/main/include/log4cxx/logger.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	5
/src/logging-log4cxx/src/main/cpp/messagebuffer.cpp	7
/usr/local/bin/../include/c++/v1/sstream	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	1
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	2
/src/logging-log4cxx/src/main/cpp/appender.cpp	1

Fuzzer: /src/logging-log4cxx/src/fuzzers/cpp/PatternConverterFuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	62	70.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	29.5%
All colors	88	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
29	58	LLVMFuzzerTestOneInput	call site: 00058
12	21	createOptions(FuzzedDataProvider*)	call site: 00021
11	5	log4cxx::spi::LocationInfo::calcShortFileName(char const*)	call site: 00005
4	0	EP	call site: 00000
3	40	LLVMFuzzerTestOneInput	call site: 00040
1	46	LLVMFuzzerTestOneInput	call site: 00046
1	50	LLVMFuzzerTestOneInput	call site: 00050
1	54	LLVMFuzzerTestOneInput	call site: 00054

Runtime coverage analysis

Covered functions

1851

Functions that are reachable but not covered

33

Reachable functions

80

Percentage of reachable functions covered

58.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/PatternConverterFuzzer.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/propertiespatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggingeventpatternconverter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/loggerpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/namepatternconverter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/pattern/classnamepatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/fulllocationpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/linelocationpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/messagepatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/lineseparatorpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/methodlocationpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/levelpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/relativetimepatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/threadusernamepatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/ndcpatternconverter.h	2
/src/logging-log4cxx/src/main/include/log4cxx/pattern/throwableinformationpatternconverter.h	2

Fuzzer: TranscoderFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	7.51%
gold	[1:9]	25	14.4%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	135	78.0%
All colors	173	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	6	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00006
2	57	LLVMFuzzerTestOneInput	call site: 00057	fprintf
2	65	log4cxx::helpers::CharsetEncoder::createDefaultEncoder()	call site: 00065
1	13	log4cxx::helpers::WideLife >::~WideLife()	call site: 00013	__cxa_begin_catch
1	16	log4cxx::helpers::CharsetDecoder::getDefaultDecoder()	call site: 00016
1	52	unsigned int decodeCodePoint (std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >::const_iterator&)	call site: 00052
1	73	log4cxx::helpers::CharsetEncoder::getDefaultEncoder()	call site: 00073
1	90	log4cxx::helpers::Transcoder::encode(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >&)	call site: 00090
1	134	log4cxx::helpers::CharsetEncoder::getEncoder(std::__1::basic_string , std::__1::allocator > const&)	call site: 00134
1	145	LLVMFuzzerTestOneInput	call site: 00145	__cxa_end_catch

Runtime coverage analysis

Covered functions

808

Functions that are reachable but not covered

11

Reachable functions

143

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/TranscoderFuzzer.cpp	8
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	16
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	8
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	10
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	9
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1

Fuzzer: HTMLLayoutFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	7.91%
gold	[1:9]	15	10.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	113	81.2%
All colors	139	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	1	LLVMFuzzerTestOneInput	call site: 00001
2	35	log4cxx::Layout::format(std::__1::basic_string , std::__1::allocator >&, std::__1::shared_ptr const&) const	call site: 00035	apr_pool_destroy
2	57	log4cxx::helpers::CharsetDecoder::createDefaultDecoder()	call site: 00057
1	12	log4cxx::helpers::WideLife >::~WideLife()	call site: 00012	__cxa_begin_catch
1	47	log4cxx::helpers::OptionConverter::toBoolean(std::__1::basic_string , std::__1::allocator > const&, bool)	call site: 00047
1	65	log4cxx::helpers::CharsetDecoder::getDefaultDecoder()	call site: 00065
1	113	LLVMFuzzerTestOneInput	call site: 00113

Runtime coverage analysis

Covered functions

854

Functions that are reachable but not covered

11

Reachable functions

135

Percentage of reachable functions covered

91.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/HTMLLayoutFuzzer.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	2
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/timezone.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	12
/src/logging-log4cxx/src/main/cpp/simpledateformat.cpp	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	4
/src/logging-log4cxx/src/main/cpp/level.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/spi/location/locationinfo.h	1
/src/logging-log4cxx/src/main/cpp/locationinfo.cpp	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/private/layout_priv.h	1
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	1
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	1
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	2
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	4
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/ndc.cpp	3
/src/logging-log4cxx/src/main/cpp/threadspecificdata.cpp	8
/src/logging-log4cxx/src/main/cpp/loggingevent.cpp	2
/src/logging-log4cxx/src/main/cpp/mdc.cpp	3

Fuzzer: DOMConfiguratorFuzzer-wchar_t

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	573	54.3%
gold	[1:9]	182	17.2%
yellow	[10:29]	4	0.37%
greenyellow	[30:49]	35	3.31%
lawngreen	50+	261	24.7%
All colors	1055	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	976	log4cxx::helpers::WideLife ::operator log4cxx::AsyncAppender::ClazzAsyncAppender&()	call site: 00976	__dynamic_cast
32	938	log4cxx::helpers::WideLife ::operator log4cxx::spi::AppenderAttachable::ClazzAppenderAttachable&()	call site: 00938	__cxa_guard_abort
17	134	log4cxx::helpers::Pool::setPool()	call site: 00134	__cxa_allocate_exception
16	692	log4cxx::xml::DOMConfigurator::DOMConfiguratorPrivate::parseChildrenOfLoggerElement(apr_xml_elem*, std::__1::shared_ptr , bool)	call site: 00692	__cxa_guard_acquire
16	755	log4cxx::config::PropertySetter::activate()	call site: 00755	__cxa_begin_catch
14	721	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00721	__cxa_guard_acquire
14	894	log4cxx::helpers::WideLife ::operator log4cxx::rolling::FilterBasedTriggeringPolicy::ClazzFilterBasedTriggeringPolicy&()	call site: 00894	__cxa_begin_catch
13	804	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00804
12	783	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00783
10	641	log4cxx::helpers::WideLife ::operator log4cxx::spi::LoggerFactory::ClazzLoggerFactory&()	call site: 00641	__cxa_begin_catch
10	652	std::__1::shared_ptr log4cxx::cast (std::__1::shared_ptr const&)	call site: 00652
9	823	log4cxx::helpers::WideLife ::operator log4cxx::AppenderSkeleton::ClazzAppenderSkeleton&()	call site: 00823

Runtime coverage analysis

Covered functions

953

Functions that are reachable but not covered

200

Reachable functions

751

Percentage of reachable functions covered

73.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/logging-log4cxx/src/fuzzers/cpp/DOMConfiguratorFuzzer.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/xml/domconfigurator.h	1
/src/logging-log4cxx/src/main/cpp/domconfigurator.cpp	26
/src/logging-log4cxx/src/main/cpp/file.cpp	7
/src/logging-log4cxx/src/main/cpp/transcoder.cpp	4
/src/logging-log4cxx/src/main/cpp/charsetdecoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/object.h	20
/src/logging-log4cxx/src/main/include/log4cxx/helpers/widelife.h	103
/src/logging-log4cxx/src/main/cpp/bytebuffer.cpp	8
/src/logging-log4cxx/src/main/include/log4cxx/private/bytebuffer_priv.h	6
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetdecoder.h	1
/src/logging-log4cxx/src/main/cpp/configurator.cpp	1
/src/logging-log4cxx/src/main/cpp/logmanager.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/helpers/aprinitializer.h	2
/src/logging-log4cxx/src/main/cpp/aprinitializer.cpp	7
/src/logging-log4cxx/src/main/cpp/date.cpp	2
/src/logging-log4cxx/src/main/cpp/loglog.cpp	14
/src/logging-log4cxx/src/main/cpp/optionconverter.cpp	7
/src/logging-log4cxx/src/main/cpp/system.cpp	1
/src/logging-log4cxx/src/main/cpp/exception.cpp	10
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/logging-log4cxx/src/main/cpp/charsetencoder.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/charsetencoder.h	1
/src/logging-log4cxx/src/main/cpp/pool.cpp	4
/src/logging-log4cxx/src/main/cpp/stringhelper.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/helpers/exception.h	4
/src/logging-log4cxx/src/main/cpp/systemerrwriter.cpp	3
/src/logging-log4cxx/src/main/cpp/writer.cpp	2
/src/logging-log4cxx/src/main/cpp/consolewriter.cpp	2
/src/logging-log4cxx/src/main/cpp/loader.cpp	9
/src/logging-log4cxx/src/main/include/log4cxx/spi/repositoryselector.h	1
/src/logging-log4cxx/src/main/cpp/class.cpp	5
/src/logging-log4cxx/src/main/include/log4cxx/private/string_c11.h	1
/src/logging-log4cxx/src/main/cpp/properties.cpp	2
/src/logging-log4cxx/src/main/cpp/level.cpp	11
/src/logging-log4cxx/src/main/include/log4cxx/level.h	1
/src/logging-log4cxx/src/main/cpp/asyncappender.cpp	2
/src/logging-log4cxx/src/main/cpp/classregistration.cpp	1
/src/logging-log4cxx/src/main/cpp/consoleappender.cpp	1
/src/logging-log4cxx/src/main/cpp/fileappender.cpp	1
/src/logging-log4cxx/src/main/cpp/odbcappender.cpp	1
/src/logging-log4cxx/src/main/cpp/smtpappender.cpp	3
/src/logging-log4cxx/src/main/cpp/jsonlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/htmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/patternlayout.cpp	1
/src/logging-log4cxx/src/main/cpp/simplelayout.cpp	1
/src/logging-log4cxx/src/main/cpp/xmllayout.cpp	1
/src/logging-log4cxx/src/main/cpp/levelmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/levelrangefilter.cpp	1
/src/logging-log4cxx/src/main/cpp/stringmatchfilter.cpp	1
/src/logging-log4cxx/src/main/cpp/locationinfofilter.cpp	1
/src/logging-log4cxx/src/main/cpp/rollingfileappender.cpp	4
/src/logging-log4cxx/src/main/cpp/sizebasedtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/timebasedrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/manualtriggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/fixedwindowrollingpolicy.cpp	1
/src/logging-log4cxx/src/main/cpp/filterbasedtriggeringpolicy.cpp	3
/src/logging-log4cxx/src/main/cpp/propertyconfigurator.cpp	1
/src/logging-log4cxx/src/main/cpp/fallbackerrorhandler.cpp	2
/src/logging-log4cxx/src/main/cpp/telnetappender.cpp	1
/src/logging-log4cxx/src/main/cpp/xmlsocketappender.cpp	1
/src/logging-log4cxx/src/main/cpp/syslogappender.cpp	1
/src/logging-log4cxx/src/main/cpp/threadutility.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/helpers/singletonholder.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/loggerfactory.h	1
/src/logging-log4cxx/src/main/cpp/propertysetter.cpp	3
/src/logging-log4cxx/src/main/include/log4cxx/spi/optionhandler.h	1
/src/logging-log4cxx/src/main/include/log4cxx/config/propertysetter.h	1
/src/logging-log4cxx/src/main/cpp/logger.cpp	4
/src/logging-log4cxx/src/main/cpp/appender.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/appender.h	1
/src/logging-log4cxx/src/main/cpp/layout.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/layout.h	1
/src/logging-log4cxx/src/main/cpp/optionhandler.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/filter.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/errorhandler.h	1
/src/logging-log4cxx/src/main/cpp/appenderskeleton.cpp	2
/src/logging-log4cxx/src/main/include/log4cxx/appenderskeleton.h	1
/src/logging-log4cxx/src/main/cpp/rollingpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/rollingfileappender.h	1
/src/logging-log4cxx/src/main/cpp/triggeringpolicy.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/triggeringpolicy.h	1
/src/logging-log4cxx/src/main/include/log4cxx/rolling/filterbasedtriggeringpolicy.h	1
/src/logging-log4cxx/src/main/cpp/filter.cpp	1
/src/logging-log4cxx/src/main/include/log4cxx/net/smtpappender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/triggeringeventevaluator.h	1
/src/logging-log4cxx/src/main/include/log4cxx/spi/appenderattachable.h	3
/src/logging-log4cxx/src/main/include/log4cxx/asyncappender.h	1
/src/logging-log4cxx/src/main/include/log4cxx/helpers/lazyptr.h	2
/src/logging-log4cxx/src/main/cpp/appenderattachableimpl.cpp	4
/src/logging-log4cxx/src/main/include/log4cxx/spi/configurator.h	1