Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Project coverage
Per-fuzzer coverage

Table of contents

Project overview: avm
High level conclusions
Reachability and coverage overview
Fuzzers overview
Project functions overview
Fuzzer details
Fuzzer: av2_dec_fuzzer
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Analyses and suggestions
Optimal target analysis
Remaining optimal interesting functions
All functions overview
Fuzz engine guidance
/src/avm/examples/av2_dec_fuzzer.cc
Dictionary
Fuzzer function priority
Runtime coverage analysis
Complex functions with low coverage
Files and Directories in report
Files in report
Directories in report
Metadata section
Report generation date: 2026-09-14

Project overview: avm

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
0.0%
7 / 3740
Cyclomatic complexity statically reachable by fuzzers
0.0%
32 / 24314
Runtime code coverage of functions
45.0%
1680 / 3740

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
av2_dec_fuzzer /src/avm/examples/av2_dec_fuzzer.cc 9 3791 2 5 73 38 av2_dec_fuzzer.cc

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name Functions filename Args Function call depth Reached by Fuzzers Runtime reached by Fuzzers Combined reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzzer details

Fuzzer: av2_dec_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1 10.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 9 90.0%
All colors 10 100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
1 2 LLVMFuzzerTestOneInput call site: 00002 avm_codec_destroy

Runtime coverage analysis

Covered functions
1778
Functions that are reachable but not covered
0
Reachable functions
9
Percentage of reachable functions covered
100.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/avm/examples/av2_dec_fuzzer.cc 1
/src/avm/av2/av2_dx_iface.c 1
/src/avm/avm/src/avm_decoder.c 4
/src/avm/avm/src/avm_codec.c 1
/src/avm/avm_ports/mem_ops.h 1

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
frame_worker_hook /src/avm/av2/av2_dx_iface.c 2 ['N/A', 'N/A'] 23 0 39 6 3 1056 0 9288 9288
parse_decode_block /src/avm/av2/decoder/decodeframe.c 9 ['N/A', 'N/A', 'int', 'int', 'N/A', 'char', 'char', 'N/A', 'int'] 13 0 605 99 37 443 0 3343 2810
predict_and_reconstruct_intra_block /src/avm/av2/decoder/decodeframe.c 7 ['N/A', 'N/A', 'N/A', 'int', 'int', 'int', 'char'] 7 0 109 18 8 102 0 1182 1058
read_coeffs_tx_intra_block /src/avm/av2/decoder/decodeframe.c 7 ['N/A', 'N/A', 'N/A', 'int', 'int', 'int', 'char'] 9 0 39 6 3 109 0 688 514
av2_highbd_dr_prediction_z3_avx2 /src/avm/avm_dsp/x86/intrapred_avx2.c 10 ['N/A', 'size_t', 'int', 'int', 'N/A', 'N/A', 'int', 'int', 'int', 'int'] 4 0 207 48 7 40 0 514 514
av2_highbd_dr_prediction_z3_idif_avx2 /src/avm/avm_dsp/x86/intrapred_avx2.c 10 ['N/A', 'size_t', 'int', 'int', 'N/A', 'N/A', 'int', 'int', 'int', 'int'] 4 0 207 48 7 42 0 471 445
predict_inter_block /src/avm/av2/decoder/decodeframe.c 3 ['N/A', 'N/A', 'char'] 13 0 86 15 6 229 0 1831 352

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
43.0%
1623 / 3740
Cyclomatic complexity statically reachable by fuzzers
62.0%
14973 / 24314

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Runtime reached by Fuzzers Combined reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzz engine guidance

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/avm/examples/av2_dec_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag


Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name 

-focus_function=['LLVMFuzzerTestOneInput']

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
av2_reset_refmv_bank 31 6 19.35% ['av2_dec_fuzzer']
get_transform_size 106 43 40.56% ['av2_dec_fuzzer']
check_sub_pu_edge 41 2 4.878% ['av2_dec_fuzzer']
bru_active_map_validation 93 2 2.150% ['av2_dec_fuzzer']
sdp_chroma_part_from_luma 58 17 29.31% ['av2_dec_fuzzer']
av2_find_mv_refs 85 33 38.82% ['av2_dec_fuzzer']
av2_setup_skip_mode_allowed 34 7 20.58% ['av2_dec_fuzzer']
setup_ref_mv_list 418 213 50.95% ['av2_dec_fuzzer']
add_tmvp_candidate 33 5 15.15% ['av2_dec_fuzzer']
add_ref_mv_candidate 488 61 12.5% ['av2_dec_fuzzer']
av2_is_dv_in_local_range 207 104 50.24% ['av2_dec_fuzzer']
choose_primary_secondary_ref_frame 52 7 13.46% ['av2_dec_fuzzer']
av2_build_one_inter_predictor 41 19 46.34% ['av2_dec_fuzzer']
dec_calc_subpel_params 85 33 38.82% ['av2_dec_fuzzer']
build_inter_predictors_8x8_and_bigger_facade 93 17 18.27% ['av2_dec_fuzzer']
build_inter_predictors_8x8_and_bigger 326 114 34.96% ['av2_dec_fuzzer']
cfl_luma_subsampling_420_hbd_ssse3 75 25 33.33% ['av2_dec_fuzzer']
cfl_luma_subsampling_444_hbd_ssse3 46 21 45.65% ['av2_dec_fuzzer']
av2_read_tilegroup_header 169 88 52.07% ['av2_dec_fuzzer']
read_uncompressed_header 1234 398 32.25% ['av2_dec_fuzzer']
activate_layer_configuration_record 54 10 18.51% ['av2_dec_fuzzer']
get_disp_order_hint 47 9 19.14% ['av2_dec_fuzzer']
check_consistent_disp_order_hint_derivation 32 4 12.5% ['av2_dec_fuzzer']
process_tip_mode 37 6 16.21% ['av2_dec_fuzzer']
tip_mode_legal_check 54 7 12.96% ['av2_dec_fuzzer']
decode_partition_sb 44 19 43.18% ['av2_dec_fuzzer']
decode_mbmi_block 59 31 52.54% ['av2_dec_fuzzer']
av2_store_xlayer_context 58 3 5.172% ['av2_dec_fuzzer']
avm_set_current_operating_point 75 28 37.33% ['av2_dec_fuzzer']
check_layerid_showable_frame_units 54 20 37.03% ['av2_dec_fuzzer']
avm_highbd_convolve_copy_avx2 156 73 46.79% ['av2_dec_fuzzer']
filt_generic_asym_highbd_ver_4px_sse4_1 141 73 51.77% ['av2_dec_fuzzer']

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
[] []
/src/avm/av2/common/x86/highbd_convolve_2d_ssse3.c [] []
/src/avm/av2/common/mvref_common.c [] []
/src/avm/av2/av2_iface_common.h [] []
/src/avm/avm_dsp/bitreader_buffer.c [] []
/src/avm/av2/common/cdef_block_sse2.c [] []
/src/avm/av2/common/blockd.c [] []
/src/avm/avm_dsp/x86/blend_a64_mask_avx2.c [] []
/src/avm/avm_dsp/binary_codes_reader.c [] []
/src/avm/avm_dsp/x86/avm_asm_stubs.c [] []
/src/avm/av2/common/x86/intra_matrix_avx2.c [] []
/src/avm/avm/src/avm_codec.c ['av2_dec_fuzzer'] ['av2_dec_fuzzer']
/src/avm/av2/common/av2_txfm.c [] []
/src/avm/av2/common/mv.h [] []
/src/avm/avm_dsp/x86/blend_a64_mask_sse4.c [] []
/src/avm/av2/common/entropy.h [] []
/src/avm/av2/common/convolve.c [] []
/src/avm/avm_dsp/blend_a64_mask.c [] []
/src/avm/avm_dsp/x86/loopfilter_sse4.c [] []
/src/avm/av2/common/restoration.c [] []
/src/avm/avm_dsp/x86/convolve_sse4_1.h [] []
/src/avm/av2/common/convolve.h [] []
/src/avm/av2/common/intra_matrix.c [] []
/src/avm/av2/common/obu_util.h [] []
/src/avm/avm_dsp/blend_a64_hmask.c [] []
/src/avm/avm/src/avm_decoder.c ['av2_dec_fuzzer'] ['av2_dec_fuzzer']
/src/avm/av2/decoder/annexF.c [] []
/src/avm/avm_dsp/avm_dsp_rtcd.c [] []
/src/avm/avm_dsp/x86/convolve_avx2.h [] []
/src/avm/avm_dsp/x86/highbd_convolve_sse2.c [] []
/src/avm/av2/common/seg_common.c [] []
/src/avm/av2/common/x86/bawp_avx2.c [] []
/src/avm/av2/common/hr_coding.h [] []
/src/avm/av2/common/reconintra.c [] []
/src/avm/av2/common/x86/cfl_ssse3.c [] []
/src/avm/avm_dsp/x86/highbd_convolve_avx2.c [] []
/src/avm/avm_dsp/entdec.c [] []
/src/avm/av2/common/cfl.c [] []
/src/avm/examples/av2_dec_fuzzer.cc ['av2_dec_fuzzer'] ['av2_dec_fuzzer']
/src/avm/avm_ports/bitops.h [] []
/src/avm/av2/common/x86/highbd_convolve_2d_avx2.c [] []
/src/avm/av2/common/av2_loopfilter.c [] []
/src/avm/av2/common/x86/highbd_jnt_convolve_sse4.c [] []
/src/avm/av2/common/thread_common.c [] []
/src/avm/avm_dsp/recenter.h [] []
/src/avm/av2/common/seg_common.h [] []
/src/avm/avm_ports/x86.h [] []
/src/avm/avm_scale/avm_scale_rtcd.c [] []
/src/avm/avm_mem/avm_mem.c [] []
/src/avm/avm_dsp/x86/highbd_intrapred_sse2.c [] []
/src/avm/av2/common/quant_common.c [] []
/src/avm/av2/common/annexA.c [] []
/src/avm/av2/common/entropymode.h [] []
/src/avm/av2/decoder/obu_lcr.c [] []
/src/avm/av2/decoder/obu_ops.c [] []
/src/avm/av2/common/mvref_common.h [] []
/src/avm/avm_dsp/x86/avm_convolve_copy_avx2.c [] []
/src/avm/av2/decoder/obu_qm.c [] []
/src/avm/avm_ports/mem_ops.h ['av2_dec_fuzzer'] ['av2_dec_fuzzer']
/src/avm/av2/common/av2_common_int.h [] []
/src/avm/avm_scale/generic/yv12config.c [] []
/src/avm/av2/common/x86/highbd_jnt_convolve_avx2.c [] []
/src/avm/av2/common/pc_wiener_filters.h [] []
/src/avm/av2/common/blockd.h [] []
/src/avm/avm_dsp/x86/intrapred_avx2.c [] []
/src/avm/av2/common/x86/cfl_avx2.c [] []
/src/avm/av2/common/common_data.h [] []
/src/avm/av2/decoder/decodemv.c [] []
/src/avm/av2/common/banding_metadata.c [] []
/src/avm/av2/common/frame_buffers.c [] []
/src/avm/av2/common/x86/highbd_inv_txfm_sse4.c [] []
/src/avm/av2/common/x86/affine_optflow_refine_avx2.c [] []
/src/avm/av2/common/x86/highbd_warp_affine_avx2.c [] []
/src/avm/av2/common/x86/reconinter_ssse3.c [] []
/src/avm/avm_dsp/x86/entdec_avx2.c [] []
/src/avm/avm_dsp/bitwriter_buffer.c [] []
/src/avm/av2/common/x86/highbd_wiener_convolve_ssse3.c [] []
/src/avm/av2/decoder/decodetxb.c [] []
/src/avm/av2/decoder/obu_atlas.c [] []
/src/avm/av2/common/x86/intra_edge_sse4.c [] []
/src/avm/av2/common/cdef_block.c [] []
/src/avm/avm_dsp/x86/blend_a64_hmask_sse4.c [] []
/src/avm/av2/common/cdef_block_avx2.c [] []
/src/avm/av2/common/x86/highbd_ccso_avx2.c [] []
/src/avm/avm/src/avm_integer.c [] []
/src/avm/av2/common/idct.c [] []
/src/avm/av2/common/av2_txfm.h [] []
/src/avm/avm_dsp/bitreader.h [] []
/src/avm/avm_scale/yv12config.h [] []
/src/avm/av2/common/intra_dip.cc [] []
/src/avm/av2/common/cdef_block_sse4.c [] []
/src/avm/av2/common/reconinter.h [] []
/src/avm/av2/common/scale.c [] []
/src/avm/avm_dsp/x86/convolve_sse2.h [] []
/src/avm/av2/common/warped_motion.c [] []
/src/avm/av2/common/obu_util.c [] []
/src/avm/av2/common/ccso.c [] []
/src/avm/av2/common/txb_common.h [] []
/src/avm/avm/internal/avm_codec_internal.h [] []
/src/avm/avm_dsp/entdec.h [] []
/src/avm/avm_dsp/avm_convolve_common.h [] []
/src/avm/avm_dsp/x86/highbd_convolve_ssse3.c [] []
/src/avm/av2/common/hr_coding.c [] []
/src/avm/av2/common/x86/optflow_refine_sse4.c [] []
/src/avm/avm_dsp/avm_convolve.c [] []
/src/avm/av2/common/alloccommon.c [] []
/src/avm/av2/decoder/obu.c [] []
/src/avm/av2/common/av2_rtcd.c [] []
/src/avm/av2/common/level.c [] []
/src/avm/av2/common/level.h [] []
/src/avm/avm_dsp/intrapred.c [] []
/src/avm/av2/common/cfl.h [] []
/src/avm/av2/common/reconintra.h [] []
/src/avm/av2/decoder/obu_ci.c [] []
/src/avm/av2/common/tip.h [] []
/src/avm/avm_dsp/x86/lpf_common_sse2.h [] []
/src/avm/av2/common/scale.h [] []
/src/avm/av2/common/gdf.h [] []
/src/avm/av2/common/reconinter.c [] []
/src/avm/av2/common/restoration.h [] []
/src/avm/av2/common/av2_inv_txfm2d.c [] []
/src/avm/av2/common/x86/cfl_sse2.c [] []
/src/avm/av2/common/x86/highbd_warp_plane_sse4.c [] []
/src/avm/avm_util/avm_thread.c [] []
/src/avm/avm_scale/generic/yv12extend.c [] []
/src/avm/av2/common/filter.h [] []
/src/avm/avm_dsp/x86/synonyms_avx2.h [] []
/src/avm/av2/common/bru.c [] []
/src/avm/avm_dsp/entcode.c [] []
/src/avm/av2/common/x86/highbd_inv_txfm_avx2.c [] []
/src/avm/av2/common/cdef.c [] []
/src/avm/avm_dsp/bitreader.c [] []
/src/avm/av2/common/tile_common.c [] []
/src/avm/av2/common/x86/av2_convolve_scale_sse4.c [] []
/src/avm/avm/src/avm_image.c [] []
/src/avm/av2/decoder/decodeframe.c [] []
/work/build/config/av2_rtcd.h [] []
/src/avm/av2/common/cdef.h [] []
/src/avm/av2/common/pred_common.c [] []
/src/avm/av2/common/timing.c [] []
/src/avm/av2/common/quant_common.h [] []
/src/avm/av2/common/warped_motion.h [] []
/src/avm/av2/common/entropy.c [] []
/src/avm/avm_ports/avm_once.h [] []
/src/avm/av2/common/cdef_block_simd.h [] []
/src/avm/av2/decoder/detokenize.c [] []
/src/avm/av2/common/x86/reconinter_avx2.c [] []
/src/avm/avm_dsp/x86/blend_a64_vmask_sse4.c [] []
/src/avm/avm_dsp/sad.c [] []
/src/avm/av2/decoder/obu_buf.c [] []
/src/avm/av2/common/x86/highbd_wiener_convolve_avx2.c [] []
/src/avm/av2/common/x86/reconinter_sse4.c [] []
/src/avm/av2/common/scan.h [] []
/src/avm/avm_dsp/x86/avm_convolve_copy_sse2.c [] []
/src/avm/av2/av2_dx_iface.c ['av2_dec_fuzzer'] ['av2_dec_fuzzer']
/src/avm/avm_dsp/avm_dsp_common.h [] []
/src/avm/avm_dsp/x86/synonyms.h [] []
/src/avm/av2/common/x86/av2_convolve_horiz_rs_sse4.c [] []
/src/avm/av2/common/gdf_block.c [] []
/src/avm/avm_dsp/x86/blend_sse4.h [] []
/src/avm/av2/common/common.h [] []
/src/avm/av2/common/entropymv.h [] []
/src/avm/avm_dsp/loopfilter.c [] []
/src/avm/avm_dsp/blend_a64_vmask.c [] []
/src/avm/av2/common/pred_common.h [] []
/src/avm/avm_dsp/prob.h [] []
/src/avm/av2/common/tile_common.h [] []
/src/avm/av2/decoder/decoder.c [] []
/src/avm/avm_dsp/grain_synthesis.c [] []
/src/avm/av2/decoder/annexF.h [] []
/src/avm/av2/decoder/decoder.h [] []
/src/avm/av2/decoder/obu_fgm.c [] []
/src/avm/av2/common/entropymv.c [] []
/src/avm/av2/common/x86/highbd_convolve_2d_sse4.c [] []
/src/avm/av2/common/cdef_block_ssse3.c [] []
/src/avm/av2/common/bru.h [] []
/src/avm/av2/common/gdf.c [] []
/src/avm/av2/common/tip.c [] []
/src/avm/av2/common/gdf_block_avx2.c [] []
/src/avm/av2/common/entropymode.c [] []

Directories in report

Directory
/src/avm/av2/common/x86/
/src/avm/avm_mem/
/src/avm/avm_dsp/
/src/avm/avm_ports/
/work/build/config/
/src/avm/av2/common/
/src/avm/av2/
/src/avm/av2/decoder/
/src/avm/avm_scale/generic/
/src/avm/examples/
/src/avm/avm_dsp/x86/
/src/avm/avm_scale/
/src/avm/avm/internal/
/src/avm/avm_util/
/src/avm/avm/src/

Metadata section

This sections shows the raw data that is used to produce this report. This is mainly used for further processing and developer debugging.

Fuzzer Calltree file Program data file Coverage file
av2_dec_fuzzer fuzzerLogFile-0-8zwJEQbbb1.data fuzzerLogFile-0-8zwJEQbbb1.data.yaml av2_dec_fuzzer.covreport