High level conclusions

Fuzzers reach 74.10% of cyclomatic complexity.

Fuzzers reach 67.92% of all functions.

Fuzzer dns_message_checksig_fuzzer is blocked:

The runtime code coverage of dns_message_checksig_fuzzer covers 12.56% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dns_message_parse_fuzzer is blocked:

The runtime code coverage of dns_message_parse_fuzzer covers 13.58% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3593 / 5290

Cyclomatic complexity statically reachable by fuzzers

27924 / 37682

Runtime code coverage of functions

1352 / 5290

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: isc_lex_getmastertoken_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	73	38.6%
gold	[1:9]	2	1.05%
yellow	[10:29]	26	13.7%
greenyellow	[30:49]	1	0.52%
lawngreen	50+	87	46.0%
All colors	189	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	192	2 : View List ['isc__mem_reget', 'isc__mem_get']	121	192	isc_buffer_reserve	call site: 00095	/src/bind9/lib/isc/./include/isc/buffer.h:1129
50	775	12 : View List ['__ctype_b_loc', 'getc_unlocked', 'isc_assertion_failed', 'isc_buffer_getuint8', '__errno_location', 'isc_error_fatal', 'pushandgrow', 'grow_data', 'isc_parse_uint32', 'isc___errno2result', 'pushback', 'ferror']	52	777	isc_lex_gettoken	call site: 00157	/src/bind9/lib/isc/lex.c:641
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00000	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
2	2	1 : View List ['flockfile']	54	779	isc_lex_gettoken	call site: 00077	/src/bind9/lib/isc/lex.c:413
2	2	1 : View List ['funlockfile']	2	2	isc_lex_gettoken	call site: 00179	/src/bind9/lib/isc/lex.c:924
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00000	/src/bind9/lib/isc/mem.c:845
0	0	None	52	777	isc_lex_gettoken	call site: 00079	/src/bind9/lib/isc/lex.c:420
0	0	None	52	777	isc_lex_gettoken	call site: 00148	/src/bind9/lib/isc/lex.c:553
0	0	None	52	777	isc_lex_gettoken	call site: 00152	/src/bind9/lib/isc/lex.c:595
0	0	None	52	777	isc_lex_gettoken	call site: 00155	/src/bind9/lib/isc/lex.c:623
0	0	None	52	777	isc_lex_gettoken	call site: 00155	/src/bind9/lib/isc/lex.c:625

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

32

Reachable functions

72

Percentage of reachable functions covered

55.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/isc_lex_getmastertoken.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/assertions.c	1
lib/isc/lex.c	8
lib/isc/mem.c	14
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	2
lib/isc/error.c	2
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/isc/./include/isc/buffer.h	14
lib/isc/errno2result.c	1
lib/isc/parseint.c	1

Fuzzer: isc_lex_gettoken_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	48.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	22	12.2%
greenyellow	[30:49]	5	2.77%
lawngreen	50+	66	36.6%
All colors	180	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	192	2 : View List ['isc__mem_reget', 'isc__mem_get']	121	192	isc_buffer_reserve	call site: 00094	/src/bind9/lib/isc/./include/isc/buffer.h:1129
63	775	12 : View List ['__ctype_b_loc', 'getc_unlocked', 'isc_assertion_failed', 'isc_buffer_getuint8', '__errno_location', 'isc_error_fatal', 'pushandgrow', 'grow_data', 'isc_parse_uint32', 'isc___errno2result', 'pushback', 'ferror']	65	777	isc_lex_gettoken	call site: 00147	/src/bind9/lib/isc/lex.c:522
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00000	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
2	2	1 : View List ['flockfile']	67	779	isc_lex_gettoken	call site: 00076	/src/bind9/lib/isc/lex.c:413
2	2	1 : View List ['funlockfile']	2	2	isc_lex_gettoken	call site: 00178	/src/bind9/lib/isc/lex.c:924
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00000	/src/bind9/lib/isc/mem.c:845
0	0	None	67	779	isc_lex_gettoken	call site: 00076	/src/bind9/lib/isc/lex.c:402
0	0	None	65	777	isc_lex_gettoken	call site: 00078	/src/bind9/lib/isc/lex.c:420
0	0	None	65	777	isc_lex_gettoken	call site: 00147	/src/bind9/lib/isc/lex.c:538
0	0	None	65	777	isc_lex_gettoken	call site: 00147	/src/bind9/lib/isc/lex.c:544
0	0	None	65	777	isc_lex_gettoken	call site: 00147	/src/bind9/lib/isc/lex.c:553

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

33

Reachable functions

69

Percentage of reachable functions covered

52.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/isc_lex_gettoken.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/assertions.c	1
lib/isc/lex.c	6
lib/isc/mem.c	14
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	2
lib/isc/error.c	2
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/isc/./include/isc/buffer.h	13
lib/isc/errno2result.c	1
lib/isc/parseint.c	1

Fuzzer: dns_name_fromtext_target_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	14.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	85.3%
All colors	41	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00000	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00000	/src/bind9/lib/isc/mem.c:845
0	0	None	36	43	dns_name_fromtext	call site: 00023	/src/bind9/lib/dns/name.c:897
0	0	None	36	43	dns_name_fromtext	call site: 00024	/src/bind9/lib/dns/name.c:971
0	0	None	36	43	dns_name_fromtext	call site: 00025	/src/bind9/lib/dns/name.c:996
0	0	None	36	43	dns_name_fromtext	call site: 00026	/src/bind9/lib/dns/name.c:1023
0	0	None	6	14	rallocx	call site: 00000	/src/bind9/lib/isc/./jemalloc_shim.h:90
0	0	None	0	0	dns_name_fromtext	call site: 00032	/src/bind9/lib/dns/name.c:1055
0	0	None	0	0	isc__os_initialize	call site: 00000	/src/bind9/lib/isc/os.c:104

Runtime coverage analysis

Covered functions

48

Functions that are reachable but not covered

6

Reachable functions

17

Percentage of reachable functions covered

64.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_name_fromtext_target.c	1
lib/dns/fixedname.c	2
lib/dns/name.c	3
lib/dns/../../lib/isc/include/isc/buffer.h	4
lib/isc/assertions.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/error.c	1
lib/isc/result.c	1

Fuzzer: dns_name_fromwire_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	4.28%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	95.7%
All colors	70	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00000	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00000	/src/bind9/lib/isc/mem.c:845
0	0	None	6	14	rallocx	call site: 00000	/src/bind9/lib/isc/./jemalloc_shim.h:90
0	0	None	4	20	old_name_fromwire	call site: 00042	/src/bind9/fuzz/./old.c:117
0	0	None	4	20	old_name_fromwire	call site: 00043	/src/bind9/fuzz/./old.c:158
0	0	None	4	20	old_name_fromwire	call site: 00043	/src/bind9/fuzz/./old.c:168
0	0	None	0	9	dns_name_fromwire	call site: 00031	/src/bind9/lib/dns/name.c:1619
0	0	None	0	0	old_name_fromwire	call site: 00047	/src/bind9/fuzz/./old.c:210
0	0	None	0	0	isc_ascii_lowerequal	call site: 00055	/src/bind9/lib/dns/../../lib/isc/include/isc/ascii.h:139
0	0	None	0	0	dns_name_equal	call site: 00052	/src/bind9/lib/dns/name.c:548
0	0	None	0	0	dns_name_equal	call site: 00052	/src/bind9/lib/dns/name.c:553

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

5

Reachable functions

23

Percentage of reachable functions covered

78.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_name_fromwire.c	1
lib/dns/fixedname.c	3
lib/dns/name.c	4
lib/dns/../../lib/isc/include/isc/buffer.h	4
lib/isc/assertions.c	1
fuzz/../lib/isc/include/isc/buffer.h	5
lib/dns/./include/dns/compress.h	1
fuzz/./old.c	1
fuzz/../lib/dns/include/dns/compress.h	1
lib/isc/error.c	1
lib/dns/../../lib/isc/include/isc/ascii.h	2

Fuzzer: dns_qpkey_name_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	78	46.1%
gold	[1:9]	1	0.59%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	53.2%
All colors	169	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
17	42	2 : View List ['dns_fixedname_initname', 'dns_name_clone']	21	46	dns_qpkey_fromname	call site: 00033	/src/bind9/lib/dns/qp.c:221
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00000	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00000	/src/bind9/lib/isc/mem.c:845
0	0	None	6	14	rallocx	call site: 00126	/src/bind9/lib/isc/./jemalloc_shim.h:90
0	0	None	0	0	isc_ascii_lowerequal	call site: 00147	/src/bind9/lib/dns/../../lib/isc/include/isc/ascii.h:139
0	0	None	0	0	dns_name_fullcompare	call site: 00157	/src/bind9/lib/dns/name.c:437
0	0	None	0	0	dns_name_equal	call site: 00144	/src/bind9/lib/dns/name.c:548
0	0	None	0	0	dns_name_equal	call site: 00144	/src/bind9/lib/dns/name.c:553
0	0	None	0	0	isc__os_initialize	call site: 00000	/src/bind9/lib/isc/os.c:104

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

28

Reachable functions

62

Percentage of reachable functions covered

54.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_qpkey_name.c	1
lib/dns/fixedname.c	3
lib/dns/name.c	8
lib/dns/../../lib/isc/include/isc/buffer.h	4
lib/isc/assertions.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/dns/./include/dns/compress.h	1
lib/dns/qp.c	1
tests/libtest/qp.c	1
tests/libtest/../../lib/isc/include/isc/buffer.h	3
tests/libtest/../../lib/dns/qp_p.h	2
lib/isc/mem.c	12
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	1
lib/isc/error.c	1
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/dns/../../lib/isc/include/isc/ascii.h	3
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1

Fuzzer: dns_qp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	326	48.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	343	51.2%
All colors	669	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
503	582	29 : View List ['strlcpy', 'isc_rwlock_rdunlock', 'isc_log_wouldlog', 'fflush', 'isc_time_subtract', 'isc__mem_put', 'isc_rwlock_rdlock', 'isc__mem_get', 'fstat', 'strlen', 'isc_time_compare', 'stat', 'pthread_mutex_lock', 'isc_time_formatISO8601ms', 'isc_time_set', 'isc_time_formattimestamp', 'syslog', 'isc_assertion_failed', 'isc_result_totext', '__errno_location', 'isc_error_fatal', 'isc_time_now', 'pthread_mutex_unlock', 'isc_string_strerror_r', 'fileno', 'strcmp', 'isc_log_open', 'isc_time_formatISO8601Lms', 'fclose']	503	582	isc_log_doit	call site: 00268	/src/bind9/lib/isc/log.c:1524
18	18	1 : View List ['attach_twigs']	18	18	dns_qp_insert	call site: 00259	/src/bind9/lib/dns/qp.c:1602
11	11	3 : View List ['mmap', 'isc_error_fatal', 'chunk_size_raw']	11	11	chunk_get_raw	call site: 00081	/src/bind9/lib/dns/qp.c:322
11	11	3 : View List ['munmap', 'isc_error_fatal', 'chunk_size_raw']	11	11	chunk_free_raw	call site: 00517	/src/bind9/lib/dns/qp.c:335
10	10	1 : View List ['print_active']	48	56	destroy	call site: 00644	/src/bind9/lib/isc/mem.c:475
10	10	1 : View List ['print_active']	14	57	isc__mem_destroy	call site: 00663	/src/bind9/lib/isc/mem.c:594
4	15	2 : View List ['isc_assertion_failed', 'mallocx']	24	35	mem_create	call site: 00014	/src/bind9/lib/isc/mem.c:440
4	4	1 : View List ['isc_assertion_failed']	4	4	free_twigs	call site: 00223	/src/bind9/lib/dns/qp.c:514
4	4	1 : View List ['isc_error_fatal']	4	4	isc__tls_initialize	call site: 00000	/src/bind9/lib/isc/tls.c:221
0	70	1 : View List ['isc__mem_free']	0	70	isc__mem_reallocate	call site: 00100	/src/bind9/lib/isc/mem.c:845
0	0	None	21	212	chunk_free	call site: 00496	/src/bind9/lib/dns/qp.c:574
0	0	None	18	61	isc__mem_destroy	call site: 00661	/src/bind9/lib/isc/mem.c:589

Runtime coverage analysis

Covered functions

118

Functions that are reachable but not covered

105

Reachable functions

194

Percentage of reachable functions covered

45.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_qp.c	1
lib/isc/mem.c	23
lib/isc/assertions.c	1
lib/isc/os.c	1
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	2
lib/isc/error.c	2
lib/dns/qp.c	28
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/dns/./qp_p.h	34
lib/isc/log.c	11
lib/isc/rwlock.c	7
lib/isc/time.c	10
lib/isc/file.c	4
lib/isc/errno2result.c	1
lib/isc/result.c	1
lib/isc/dir.c	5
lib/isc/errno.c	1
lib/isc/stdio.c	1
tests/libtest/qp.c	6
tests/libtest/../../lib/dns/qp_p.h	17

Fuzzer: dns_message_parse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2078	48.4%
gold	[1:9]	11	0.25%
yellow	[10:29]	3	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2193	51.1%
All colors	4285	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2363	2363	1 : View List ['dns_message_pseudosectiontoyaml']	2363	2363	dns_message_pseudosectiontotext	call site: 02113	/src/bind9/lib/dns/message.c:3854
1920	1920	1 : View List ['dns_ncache_towire']	1920	1920	towiresorted	call site: 03588	/src/bind9/lib/dns/rdataset.c:337
1503	1503	1 : View List ['dns_tsig_sign']	2575	6762	dns_message_renderend	call site: 03900	/src/bind9/lib/dns/message.c:2299
1072	3094	3 : View List ['dns_message_renderrelease', 'dns_dnssec_signmessage', 'renderset']	1072	3237	dns_message_renderend	call site: 04232	/src/bind9/lib/dns/message.c:2318
437	582	29 : View List ['strlcpy', 'isc_rwlock_rdunlock', 'isc_log_wouldlog', 'fflush', 'isc_time_subtract', 'isc__mem_put', 'isc_rwlock_rdlock', 'isc__mem_get', 'fstat', 'strlen', 'isc_time_compare', 'stat', 'pthread_mutex_lock', 'isc_time_formatISO8601ms', 'isc_time_set', 'isc_time_formattimestamp', 'syslog', 'isc_assertion_failed', 'isc_result_totext', '__errno_location', 'isc_error_fatal', 'isc_time_now', 'pthread_mutex_unlock', 'isc_string_strerror_r', 'fileno', 'strcmp', 'isc_log_open', 'isc_time_formatISO8601Lms', 'fclose']	437	582	isc_log_doit	call site: 01575	/src/bind9/lib/isc/log.c:1524
175	213	3 : View List ['dns_name_format', 'dns_name_fromregion', 'dns_name_init']	191	295	generic_totext_key	call site: 03042	/src/bind9/lib/dns/./rdata/generic/key_25.c:157
156	156	5 : View List ['dns_name_caseequal', 'dns_name_countlabels', 'dns_name_getlabelsequence', 'dns_name_issubdomain', 'dns_name_compare']	156	156	name_prefix	call site: 02978	/src/bind9/lib/dns/rdata.c:1858
154	154	1 : View List ['dns_tsigkey_detach']	479	710	msgreset	call site: 01821	/src/bind9/lib/dns/message.c:609
145	145	1 : View List ['dst_context_destroy']	325	556	msgreset	call site: 01822	/src/bind9/lib/dns/message.c:614
121	192	2 : View List ['isc__mem_reget', 'isc__mem_get']	121	192	isc_buffer_reserve	call site: 00812	/src/bind9/lib/isc/./include/isc/buffer.h:1129
104	104	1 : View List ['dns_aclenv_detach']	160	182	msgreset	call site: 01892	/src/bind9/lib/dns/message.c:647
84	383	12 : View List ['isc_time_set', 'dst_region_computeid', 'isc_base64_totext', 'dns_rdata_toregion', 'uint32_fromregion', 'isc_time_formathttptimestamp', 'isc_assertion_failed', 'uint16_fromregion', 'isc_stdtime_now', 'dns_time32_totext', 'dns_secalg_format', 'str_totext.828']	84	383	totext_keydata	call site: 03335	/src/bind9/lib/dns/./rdata/generic/keydata_65533.c:101

Runtime coverage analysis

Covered functions

539

Functions that are reachable but not covered

3211

Reachable functions

3716

Percentage of reachable functions covered

13.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_message_parse.c	4
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/assertions.c	1
lib/dns/message.c	62
lib/isc/mem.c	24
lib/isc/./jemalloc_shim.h	3
lib/isc/string.c	3
lib/isc/error.c	2
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/dns/../../lib/isc/include/isc/buffer.h	29
lib/dns/fixedname.c	3
lib/dns/name.c	29
lib/dns/./include/dns/compress.h	2
lib/dns/../../lib/isc/include/isc/ascii.h	4
lib/dns/rdatalist.c	3
lib/dns/rdataset.c	14
lib/dns/rdata.c	42
lib/dns/./rdata/in_1/a_1.c	7
lib/dns/./rdata/ch_3/a_1.c	7
lib/dns/./rdata/hs_4/a_1.c	7
lib/dns/./rdata/generic/ns_2.c	7
lib/dns/./rdata/generic/md_3.c	7
lib/dns/./rdata/generic/mf_4.c	7
lib/dns/./rdata/generic/cname_5.c	7
lib/dns/./rdata/generic/soa_6.c	7
lib/dns/./rdata/generic/mb_7.c	7
lib/dns/./rdata/generic/mg_8.c	7
lib/dns/./rdata/generic/mr_9.c	7
lib/dns/./rdata/generic/null_10.c	7
lib/dns/./rdata/in_1/wks_11.c	7
lib/dns/./rdata/generic/ptr_12.c	7
lib/dns/./rdata/generic/hinfo_13.c	7
lib/dns/./rdata/generic/minfo_14.c	7
lib/dns/./rdata/generic/mx_15.c	7
lib/dns/./rdata/generic/txt_16.c	11
lib/dns/./rdata/generic/rp_17.c	7
lib/dns/./rdata/generic/afsdb_18.c	7
lib/dns/./rdata/generic/x25_19.c	7
lib/dns/./rdata/generic/isdn_20.c	7
lib/dns/./rdata/generic/rt_21.c	7
lib/dns/./rdata/in_1/nsap_22.c	7
lib/dns/./rdata/in_1/nsap-ptr_23.c	7
lib/dns/./rdata/generic/sig_24.c	8
lib/dns/./rdata/generic/key_25.c	12
lib/dns/./rdata/in_1/px_26.c	7
lib/dns/./rdata/generic/gpos_27.c	7
lib/dns/./rdata/in_1/aaaa_28.c	7
lib/dns/./rdata/generic/loc_29.c	7
lib/dns/./rdata/generic/nxt_30.c	7
lib/dns/./rdata/in_1/eid_31.c	7
lib/dns/./rdata/in_1/nimloc_32.c	7
lib/dns/./rdata/in_1/srv_33.c	7
lib/dns/./rdata/in_1/atma_34.c	7
lib/dns/./rdata/generic/naptr_35.c	8
lib/isc/regex.c	1
lib/dns/./rdata/in_1/kx_36.c	7
lib/dns/./rdata/generic/cert_37.c	7
lib/dns/./rdata/in_1/a6_38.c	7
lib/dns/./rdata/generic/dname_39.c	7
lib/dns/./rdata/generic/sink_40.c	7
lib/dns/./rdata/generic/opt_41.c	7
lib/isc/utf8.c	2
lib/dns/./rdata/in_1/apl_42.c	7
lib/dns/./rdata/generic/ds_43.c	11
lib/isc/md.c	1
lib/dns/./rdata/generic/sshfp_44.c	7
lib/dns/./rdata/generic/ipseckey_45.c	7
lib/dns/./rdata/generic/rrsig_46.c	8
lib/dns/./rdata/generic/nsec_47.c	7
lib/dns/./rdata/generic/dnskey_48.c	7
lib/dns/./rdata/in_1/dhcid_49.c	7
lib/dns/./rdata/generic/nsec3_50.c	7
lib/dns/./rdata/generic/nsec3param_51.c	7
lib/dns/./rdata/generic/tlsa_52.c	11
lib/dns/./rdata/generic/smimea_53.c	7
lib/dns/./rdata/generic/hip_55.c	9
lib/dns/./rdata/generic/ninfo_56.c	7
lib/dns/./rdata/generic/rkey_57.c	7
lib/dns/./rdata/generic/talink_58.c	7
lib/dns/./rdata/generic/cds_59.c	7
lib/dns/./rdata/generic/cdnskey_60.c	7
lib/dns/./rdata/generic/openpgpkey_61.c	7
lib/dns/./rdata/generic/csync_62.c	7
lib/dns/./rdata/generic/zonemd_63.c	7
lib/dns/./rdata/in_1/svcb_64.c	14
lib/dns/./rdata/in_1/https_65.c	7
lib/dns/./rdata/generic/spf_99.c	7
lib/dns/./rdata/generic/nid_104.c	7
lib/dns/./rdata/generic/l32_105.c	7
lib/dns/./rdata/generic/l64_106.c	7
lib/dns/./rdata/generic/lp_107.c	7
lib/dns/./rdata/generic/eui48_108.c	7
lib/dns/./rdata/generic/eui64_109.c	7
lib/dns/./rdata/generic/tkey_249.c	7
lib/dns/./rdata/any_255/tsig_250.c	7
lib/dns/./rdata/generic/uri_256.c	7
lib/dns/./rdata/generic/caa_257.c	7
lib/dns/./rdata/generic/avc_258.c	7
lib/dns/./rdata/generic/doa_259.c	7
lib/dns/./rdata/generic/amtrelay_260.c	7
lib/dns/./rdata/generic/ta_32768.c	7
lib/dns/./rdata/generic/dlv_32769.c	7
lib/dns/./rdata/generic/keydata_65533.c	7
lib/isc/base32.c	8
lib/isc/./include/isc/buffer.h	2
lib/isc/region.c	1
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/isc/log.c	11
lib/isc/rwlock.c	9
lib/isc/time.c	10
lib/isc/file.c	4
lib/isc/errno2result.c	1
lib/isc/result.c	1
lib/isc/dir.c	5
lib/isc/errno.c	1
lib/isc/stdio.c	1
lib/dns/tsig.c	4
lib/dns/dst_api.c	9
lib/isc/safe.c	1
lib/isc/os.c	1
lib/dns/acl.c	4
lib/dns/iptable.c	2
lib/isc/radix.c	3
lib/dns/masterdump.c	9
lib/dns/rcode.c	9
lib/dns/ttl.c	2
lib/dns/ncache.c	2
lib/isc/hex.c	2
lib/dns/time.c	2
lib/isc/stdtime.c	1
lib/isc/serial.c	1
lib/isc/base64.c	2
lib/dns/key.c	5
lib/dns/compress.c	13
lib/dns/../../lib/isc/include/isc/hash.h	1
lib/isc/random.c	4
lib/isc/entropy.c	1
lib/dns/dnssec.c	1

Fuzzer: dns_message_checksig_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7341	84.6%
gold	[1:9]	161	1.85%
yellow	[10:29]	72	0.83%
greenyellow	[30:49]	44	0.50%
lawngreen	50+	1053	12.1%
All colors	8671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
55532	55801	13 : View List ['dns__rdataset_disassociate', 'dns_name_format', 'resume_addnsec3chain', 'set_resigntime', 'dns_zone_isdynamic', 'dns__db_getsigningtime', 'dnssec_log', 'dns_zone_getsigresigninginterval', 'dns_fixedname_initname', 'resume_signingwithkey', 'isc_stdtime_now', 'dns_rdataset_init', 'dns_rdatatype_format']	109810	111568	zone_postload	call site: 00000	/src/bind9/lib/dns/zone.c:5179
54246	54246	1 : View List ['zone_needdump']	164056	165814	zone_postload	call site: 00000	/src/bind9/lib/dns/zone.c:5171
28150	56912	5 : View List ['dns_zone_catz_disable_db', 'dns_remote_addresses', 'zone_saveunique', 'zone_replacedb', 'dns_zone_rpz_disable_db']	247271	278392	zone_postload	call site: 00000	/src/bind9/lib/dns/zone.c:5134
27216	27216	2 : View List ['dns_catz_zones_detach', 'dns_catz_shutdown_catzs']	34897	116297	dns_view_detach	call site: 00000	/src/bind9/lib/dns/view.c:521
27121	27121	1 : View List ['dns_resolver_shutdown']	119468	200868	dns_view_detach	call site: 00000	/src/bind9/lib/dns/view.c:471
27120	27142	3 : View List ['zmgr_resume_xfrs', 'isc_rwlock_wrlock', 'isc_rwlock_wrunlock']	84431	146367	zone_shutdown	call site: 00000	/src/bind9/lib/dns/zone.c:14528
27120	27120	1 : View List ['dns_zone_flush']	62017	143417	dns_view_detach	call site: 00000	/src/bind9/lib/dns/view.c:514
27120	27120	1 : View List ['dns_zone_idetach']	27120	54279	zone_shutdown	call site: 00000	/src/bind9/lib/dns/zone.c:14634
27119	27119	1 : View List ['process_zone_setnsec3param']	334641	381490	zone_postload	call site: 00000	/src/bind9/lib/dns/zone.c:4874
27117	27117	1 : View List ['dns_xfrin_shutdown']	57271	119185	zone_shutdown	call site: 00000	/src/bind9/lib/dns/zone.c:14548
7192	22471	51 : View List ['isc_buffer_init.7867', 'dns_rdatalist_init', 'dns_name_fromtext', 'is_glue', 'dns_rdatatype_fromtext', 'isc__mem_strdup', 'strcasecmp', 'dns_rdata_checkowner', 'isc_stdtime_now', 'dns_rdatatype_atparent', 'pushfile', 'strncasecmp', 'dns_name_format', 'dns_rdata_checksvcb', 'dns_rdata_tostruct', 'isc_result_totext', 'isc_lex_getsourceline', 'isc_error_fatal', 'isc_lex_close', 'find_free_name', 'limit_ttl', 'isc_lex_ungettoken', 'grow_rdata', 'isc_lex_getsourcename', 'dns_rdataclass_fromtext', 'dns_name_issubdomain', 'gettoken', 'dns_soa_getminimum', 'check_wildcard', 'isc_error_unexpected', 'dns_master_isprimary', 'isc_lex_isfile', 'dns_rdata_init', 'isc_buffer_setactive.7911', 'dns_time64_fromtext', 'dns_fixedname_initname', 'dns_rdataclass_format', 'check_ns', 'dns_rdatatype_ismeta', 'generate', 'dns_rdatatype_format', 'dns_name_isdnssd', 'dns_name_caseequal', 'dns_ttl_fromtext', 'incctx_destroy', 'isc_serial_lt', 'dns_rdata_covers', 'grow_rdatalist', 'dns_name_equal', 'isc_buffer_add.7857', 'dns_rdata_fromtext']	7240	29567	load_text	call site: 00000	/src/bind9/lib/dns/master.c:1099
5797	5815	8 : View List ['isc_result_totext', 'dns__db_closeversion', 'dns_db_currentversion', 'dns_keytable_detach', 'dnssec_log', 'dns_db_origin', 'dns_zoneverify_dnssec', 'dns_view_getsecroots']	5797	5815	dns_zone_verifydb	call site: 00000	/src/bind9/lib/dns/zone.c:23284

Runtime coverage analysis

Covered functions

694

Functions that are reachable but not covered

3251

Reachable functions

3718

Percentage of reachable functions covered

12.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_message_checksig.c	2
fuzz/../lib/isc/include/isc/buffer.h	6
lib/isc/assertions.c	1
lib/isc/mem.c	28
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	4
lib/isc/error.c	2
lib/isc/hash.c	3
lib/isc/siphash.c	2
lib/isc/./include/isc/ascii.h	5
lib/dns/message.c	79
lib/dns/../../lib/isc/include/isc/buffer.h	29
lib/dns/fixedname.c	3
lib/dns/name.c	35
lib/dns/./include/dns/compress.h	2
lib/dns/../../lib/isc/include/isc/ascii.h	5
lib/dns/rdatalist.c	3
lib/dns/rdataset.c	17
lib/dns/rdata.c	45
lib/dns/./rdata/in_1/a_1.c	8
lib/dns/./rdata/ch_3/a_1.c	8
lib/dns/./rdata/hs_4/a_1.c	8
lib/dns/./rdata/generic/ns_2.c	8
lib/dns/./rdata/generic/md_3.c	8
lib/dns/./rdata/generic/mf_4.c	8
lib/dns/./rdata/generic/cname_5.c	8
lib/dns/./rdata/generic/soa_6.c	8
lib/dns/./rdata/generic/mb_7.c	8
lib/dns/./rdata/generic/mg_8.c	8
lib/dns/./rdata/generic/mr_9.c	8
lib/dns/./rdata/generic/null_10.c	8
lib/dns/./rdata/in_1/wks_11.c	8
lib/dns/./rdata/generic/ptr_12.c	8
lib/dns/./rdata/generic/hinfo_13.c	8
lib/dns/./rdata/generic/minfo_14.c	8
lib/dns/./rdata/generic/mx_15.c	8
lib/dns/./rdata/generic/txt_16.c	13
lib/dns/./rdata/generic/rp_17.c	8
lib/dns/./rdata/generic/afsdb_18.c	8
lib/dns/./rdata/generic/x25_19.c	8
lib/dns/./rdata/generic/isdn_20.c	8
lib/dns/./rdata/generic/rt_21.c	8
lib/dns/./rdata/in_1/nsap_22.c	8
lib/dns/./rdata/in_1/nsap-ptr_23.c	8
lib/dns/./rdata/generic/sig_24.c	9
lib/dns/./rdata/generic/key_25.c	14
lib/dns/./rdata/in_1/px_26.c	8
lib/dns/./rdata/generic/gpos_27.c	8
lib/dns/./rdata/in_1/aaaa_28.c	8
lib/dns/./rdata/generic/loc_29.c	8
lib/dns/./rdata/generic/nxt_30.c	8
lib/dns/./rdata/in_1/eid_31.c	8
lib/dns/./rdata/in_1/nimloc_32.c	8
lib/dns/./rdata/in_1/srv_33.c	8
lib/dns/./rdata/in_1/atma_34.c	8
lib/dns/./rdata/generic/naptr_35.c	9
lib/isc/regex.c	1
lib/dns/./rdata/in_1/kx_36.c	8
lib/dns/./rdata/generic/cert_37.c	8
lib/dns/./rdata/in_1/a6_38.c	8
lib/dns/./rdata/generic/dname_39.c	8
lib/dns/./rdata/generic/sink_40.c	8
lib/dns/./rdata/generic/opt_41.c	8
lib/isc/utf8.c	2
lib/dns/./rdata/in_1/apl_42.c	8
lib/dns/./rdata/generic/ds_43.c	12
lib/isc/md.c	1
lib/dns/./rdata/generic/sshfp_44.c	8
lib/dns/./rdata/generic/ipseckey_45.c	8
lib/dns/./rdata/generic/rrsig_46.c	9
lib/dns/./rdata/generic/nsec_47.c	8
lib/dns/./rdata/generic/dnskey_48.c	8
lib/dns/./rdata/in_1/dhcid_49.c	8
lib/dns/./rdata/generic/nsec3_50.c	8
lib/dns/./rdata/generic/nsec3param_51.c	8
lib/dns/./rdata/generic/tlsa_52.c	13
lib/dns/./rdata/generic/smimea_53.c	8
lib/dns/./rdata/generic/hip_55.c	10
lib/dns/./rdata/generic/ninfo_56.c	8
lib/dns/./rdata/generic/rkey_57.c	8
lib/dns/./rdata/generic/talink_58.c	8
lib/dns/./rdata/generic/cds_59.c	8
lib/dns/./rdata/generic/cdnskey_60.c	8
lib/dns/./rdata/generic/openpgpkey_61.c	8
lib/dns/./rdata/generic/csync_62.c	8
lib/dns/./rdata/generic/zonemd_63.c	8
lib/dns/./rdata/in_1/svcb_64.c	16
lib/dns/./rdata/in_1/https_65.c	8
lib/dns/./rdata/generic/spf_99.c	8
lib/dns/./rdata/generic/nid_104.c	8
lib/dns/./rdata/generic/l32_105.c	8
lib/dns/./rdata/generic/l64_106.c	8
lib/dns/./rdata/generic/lp_107.c	8
lib/dns/./rdata/generic/eui48_108.c	8
lib/dns/./rdata/generic/eui64_109.c	8
lib/dns/./rdata/generic/tkey_249.c	8
lib/dns/./rdata/any_255/tsig_250.c	8
lib/dns/./rdata/generic/uri_256.c	8
lib/dns/./rdata/generic/caa_257.c	8
lib/dns/./rdata/generic/avc_258.c	8
lib/dns/./rdata/generic/doa_259.c	8
lib/dns/./rdata/generic/amtrelay_260.c	8
lib/dns/./rdata/generic/ta_32768.c	8
lib/dns/./rdata/generic/dlv_32769.c	8
lib/dns/./rdata/generic/keydata_65533.c	8
lib/isc/base32.c	8
lib/isc/./include/isc/buffer.h	20
lib/isc/region.c	1
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/isc/log.c	12
lib/isc/rwlock.c	16
lib/isc/time.c	16
lib/isc/file.c	4
lib/isc/errno2result.c	1
lib/isc/result.c	1
lib/isc/dir.c	5
lib/isc/errno.c	1
lib/isc/stdio.c	1
lib/dns/tsig.c	21
lib/dns/dst_api.c	16
lib/isc/safe.c	1
lib/isc/os.c	1
lib/dns/acl.c	7
lib/dns/iptable.c	2
lib/isc/radix.c	5
lib/dns/masterdump.c	9
lib/dns/rcode.c	10
lib/dns/ttl.c	2
lib/dns/ncache.c	2
lib/isc/hex.c	2
lib/dns/time.c	2
lib/isc/stdtime.c	1
lib/isc/serial.c	2
lib/isc/base64.c	2
lib/dns/key.c	8
lib/dns/view.c	10
lib/dns/rbt.c	37
lib/dns/../../lib/isc/include/isc/hash.h	1
lib/dns/zt.c	1
lib/dns/qp.c	9
lib/dns/./qp_p.h	22
lib/dns/../../lib/isc/include/isc/tid.h	1
lib/dns/zone.c	7
lib/dns/db.c	8
lib/dns/resolver.c	68
lib/isc/loop.c	6
lib/isc/hashmap.c	20
lib/isc/./include/isc/hash.h	1
lib/isc/counter.c	6
lib/isc/sockaddr.c	18
lib/isc/netaddr.c	8
lib/dns/forward.c	1
lib/isc/stats.c	2
lib/dns/adb.c	68
lib/isc/timer.c	7
lib/isc/./include/isc/tid.h	1
lib/isc/random.c	6
lib/isc/entropy.c	1
lib/dns/dispatch.c	48
lib/dns/transport.c	15
lib/isc/netmgr/netmgr.c	65
lib/isc/async.c	1
lib/isc/netmgr/udp.c	10
lib/isc/netmgr/tlsstream.c	36
lib/isc/netmgr/streamdns.c	31
lib/isc/netmgr/http.c	40
lib/isc/netmgr/tcp.c	17
lib/isc/quota.c	1
lib/isc/job.c	2
lib/isc/uv.c	1
lib/isc/tls.c	29
lib/isc/ht.c	19
lib/isc/./include/isc/dnsstream.h	14
lib/isc/netmgr/timer.c	6
lib/isc/url.c	4
lib/dns/validator.c	8
lib/dns/peer.c	12
lib/dns/keytable.c	1
lib/dns/nta.c	1
lib/dns/compress.c	13
lib/dns/dnssec.c	2
lib/dns/stats.c	2
lib/isc/netmgr/socket.c	9
lib/dns/badcache.c	2

Fuzzer: dns_rdata_fromtext_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	217	13.7%
gold	[1:9]	249	15.7%
yellow	[10:29]	225	14.2%
greenyellow	[30:49]	64	4.04%
lawngreen	50+	828	52.3%
All colors	1583	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
216	216	2 : View List ['dns_name_ishostname', 'warn_badname']	216	749	fromtext_ch_a	call site: 00892	/src/bind9/lib/dns/./rdata/ch_3/a_1.c:46
188	188	1 : View List ['warn_badname']	188	1002	generic_fromtext_in_svcb	call site: 01401	/src/bind9/lib/dns/./rdata/in_1/svcb_64.c:617
188	188	1 : View List ['warn_badname']	188	188	fromtext_afsdb	call site: 01073	/src/bind9/lib/dns/./rdata/generic/afsdb_18.c:62
188	188	1 : View List ['warn_badname']	188	188	fromtext_mx	call site: 01058	/src/bind9/lib/dns/./rdata/generic/mx_15.c:93
188	188	1 : View List ['warn_badname']	188	188	fromtext_ns	call site: 00938	/src/bind9/lib/dns/./rdata/generic/ns_2.c:48
188	188	1 : View List ['warn_badname']	188	188	fromtext_rt	call site: 01083	/src/bind9/lib/dns/./rdata/generic/rt_21.c:57
188	188	1 : View List ['warn_badname']	188	188	fromtext_in_a6	call site: 01268	/src/bind9/lib/dns/./rdata/in_1/a6_38.c:93
121	192	2 : View List ['isc__mem_reget', 'isc__mem_get']	121	192	isc_buffer_reserve	call site: 00122	/src/bind9/lib/isc/./include/isc/buffer.h:1129
50	775	12 : View List ['__ctype_b_loc', 'getc_unlocked', 'isc_assertion_failed', 'isc_buffer_getuint8', '__errno_location', 'isc_error_fatal', 'pushandgrow', 'grow_data', 'isc_parse_uint32', 'isc___errno2result', 'pushback', 'ferror']	52	777	isc_lex_gettoken	call site: 00184	/src/bind9/lib/isc/lex.c:641
28	28	1 : View List ['dns_name_ishostname']	216	227	fromtext_afsdb	call site: 01072	/src/bind9/lib/dns/./rdata/generic/afsdb_18.c:56
28	28	1 : View List ['dns_name_ishostname']	216	227	fromtext_mx	call site: 01057	/src/bind9/lib/dns/./rdata/generic/mx_15.c:87
28	28	1 : View List ['dns_name_ishostname']	216	227	fromtext_ns	call site: 00936	/src/bind9/lib/dns/./rdata/generic/ns_2.c:42

Runtime coverage analysis

Covered functions

363

Functions that are reachable but not covered

67

Reachable functions

406

Percentage of reachable functions covered

83.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_rdata_fromtext.c	1
lib/isc/mem.c	19
lib/isc/assertions.c	1
lib/isc/os.c	1
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	3
lib/isc/error.c	2
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/lex.c	15
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/isc/./include/isc/buffer.h	16
lib/isc/errno2result.c	1
lib/isc/parseint.c	2
lib/dns/rcode.c	10
lib/dns/rdata.c	29
lib/dns/name.c	10
lib/isc/result.c	1
lib/dns/../../lib/isc/include/isc/buffer.h	19
lib/isc/hex.c	6
lib/dns/./rdata/in_1/a_1.c	2
lib/dns/./rdata/ch_3/a_1.c	2
lib/dns/./include/dns/compress.h	2
lib/dns/./rdata/hs_4/a_1.c	2
lib/dns/./rdata/generic/ns_2.c	2
lib/dns/./rdata/generic/md_3.c	2
lib/dns/./rdata/generic/mf_4.c	2
lib/dns/./rdata/generic/cname_5.c	2
lib/dns/./rdata/generic/soa_6.c	2
lib/dns/./rdata/generic/mb_7.c	2
lib/dns/./rdata/generic/mg_8.c	2
lib/dns/./rdata/generic/mr_9.c	2
lib/dns/./rdata/generic/null_10.c	2
lib/dns/./rdata/in_1/wks_11.c	5
lib/dns/./rdata/generic/ptr_12.c	2
lib/dns/./rdata/generic/hinfo_13.c	2
lib/dns/./rdata/generic/minfo_14.c	2
lib/dns/./rdata/generic/mx_15.c	3
lib/dns/./rdata/generic/txt_16.c	4
lib/dns/./rdata/generic/rp_17.c	2
lib/dns/./rdata/generic/afsdb_18.c	2
lib/dns/./rdata/generic/x25_19.c	2
lib/dns/./rdata/generic/isdn_20.c	2
lib/dns/./rdata/generic/rt_21.c	2
lib/dns/./rdata/in_1/nsap_22.c	2
lib/dns/./rdata/in_1/nsap-ptr_23.c	2
lib/dns/./rdata/generic/sig_24.c	2
lib/dns/fixedname.c	3
lib/dns/./rdata/generic/key_25.c	5
lib/dns/./rdata/in_1/px_26.c	2
lib/dns/./rdata/generic/gpos_27.c	2
lib/dns/./rdata/in_1/aaaa_28.c	2
lib/dns/./rdata/generic/loc_29.c	17
lib/dns/./rdata/generic/nxt_30.c	2
lib/dns/./rdata/in_1/eid_31.c	2
lib/dns/./rdata/in_1/nimloc_32.c	2
lib/dns/./rdata/in_1/srv_33.c	2
lib/dns/./rdata/in_1/atma_34.c	2
lib/dns/./rdata/generic/naptr_35.c	3
lib/isc/regex.c	1
lib/dns/./rdata/in_1/kx_36.c	2
lib/dns/./rdata/generic/cert_37.c	2
lib/dns/./rdata/in_1/a6_38.c	2
lib/dns/./rdata/generic/dname_39.c	2
lib/dns/./rdata/generic/sink_40.c	2
lib/dns/./rdata/generic/opt_41.c	2
lib/isc/utf8.c	2
lib/dns/./rdata/in_1/apl_42.c	2
lib/dns/./rdata/generic/ds_43.c	4
lib/isc/md.c	1
lib/dns/./rdata/generic/sshfp_44.c	2
lib/dns/./rdata/generic/ipseckey_45.c	2
lib/dns/./rdata/generic/rrsig_46.c	2
lib/dns/./rdata/generic/nsec_47.c	2
lib/dns/./rdata/generic/dnskey_48.c	2
lib/dns/./rdata/in_1/dhcid_49.c	2
lib/dns/./rdata/generic/nsec3_50.c	2
lib/dns/./rdata/generic/nsec3param_51.c	2
lib/dns/./rdata/generic/tlsa_52.c	4
lib/dns/./rdata/generic/smimea_53.c	2
lib/dns/./rdata/generic/hip_55.c	2
lib/dns/./rdata/generic/ninfo_56.c	2
lib/dns/./rdata/generic/rkey_57.c	2
lib/dns/./rdata/generic/talink_58.c	2
lib/dns/./rdata/generic/cds_59.c	2
lib/dns/./rdata/generic/cdnskey_60.c	2
lib/dns/./rdata/generic/openpgpkey_61.c	2
lib/dns/./rdata/generic/csync_62.c	2
lib/dns/./rdata/generic/zonemd_63.c	2
lib/dns/./rdata/in_1/svcb_64.c	11
lib/dns/./rdata/in_1/https_65.c	2
lib/dns/./rdata/generic/spf_99.c	2
lib/dns/./rdata/generic/nid_104.c	2
lib/dns/./rdata/generic/l32_105.c	2
lib/dns/./rdata/generic/l64_106.c	2
lib/dns/./rdata/generic/lp_107.c	2
lib/dns/./rdata/generic/eui48_108.c	2
lib/dns/./rdata/generic/eui64_109.c	2
lib/dns/./rdata/generic/tkey_249.c	2
lib/dns/./rdata/any_255/tsig_250.c	2
lib/dns/./rdata/generic/uri_256.c	2
lib/dns/./rdata/generic/caa_257.c	2
lib/dns/./rdata/generic/avc_258.c	2
lib/dns/./rdata/generic/doa_259.c	2
lib/dns/./rdata/generic/amtrelay_260.c	2
lib/dns/./rdata/generic/ta_32768.c	2
lib/dns/./rdata/generic/dlv_32769.c	2
lib/dns/./rdata/generic/keydata_65533.c	2
lib/dns/ttl.c	2
lib/dns/../../lib/isc/include/isc/ascii.h	3
lib/dns/time.c	2
lib/isc/base64.c	6
lib/isc/base32.c	5

Fuzzer: dns_rdata_fromwire_text_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	476	27.6%
gold	[1:9]	38	2.20%
yellow	[10:29]	101	5.86%
greenyellow	[30:49]	101	5.86%
lawngreen	50+	1005	58.3%
All colors	1721	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
216	216	2 : View List ['dns_name_ishostname', 'warn_badname']	216	749	fromtext_ch_a	call site: 00000	/src/bind9/lib/dns/./rdata/ch_3/a_1.c:46
188	188	1 : View List ['warn_badname']	188	1002	generic_fromtext_in_svcb	call site: 00000	/src/bind9/lib/dns/./rdata/in_1/svcb_64.c:617
188	188	1 : View List ['warn_badname']	188	188	fromtext_afsdb	call site: 00000	/src/bind9/lib/dns/./rdata/generic/afsdb_18.c:62
188	188	1 : View List ['warn_badname']	188	188	fromtext_mx	call site: 00000	/src/bind9/lib/dns/./rdata/generic/mx_15.c:93
188	188	1 : View List ['warn_badname']	188	188	fromtext_ns	call site: 00000	/src/bind9/lib/dns/./rdata/generic/ns_2.c:48
188	188	1 : View List ['warn_badname']	188	188	fromtext_rt	call site: 00000	/src/bind9/lib/dns/./rdata/generic/rt_21.c:57
188	188	1 : View List ['warn_badname']	188	188	fromtext_in_a6	call site: 00000	/src/bind9/lib/dns/./rdata/in_1/a6_38.c:93
188	188	1 : View List ['warn_badname']	188	188	fromtext_in_srv	call site: 00000	/src/bind9/lib/dns/./rdata/in_1/srv_33.c:83
121	192	2 : View List ['isc__mem_reget', 'isc__mem_get']	121	192	isc_buffer_reserve	call site: 00022	/src/bind9/lib/isc/./include/isc/buffer.h:1129
116	116	4 : View List ['dns_name_issubdomain', 'dns_name_caseequal', 'dns_name_countlabels', 'dns_name_getlabelsequence']	116	116	name_prefix	call site: 00970	/src/bind9/lib/dns/rdata.c:1862
77	77	5 : View List ['probe_distance', 'slot_index', 'hash_label', 'insert', 'match_suffix']	77	77	dns_compress_name	call site: 00000	/src/bind9/lib/dns/compress.c:289
28	28	1 : View List ['dns_name_ishostname']	216	227	fromtext_afsdb	call site: 00000	/src/bind9/lib/dns/./rdata/generic/afsdb_18.c:56

Runtime coverage analysis

Covered functions

564

Functions that are reachable but not covered

379

Reachable functions

913

Percentage of reachable functions covered

58.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_rdata_fromwire_text.c	2
lib/dns/rdata.c	28
lib/dns/../../lib/isc/include/isc/buffer.h	12
lib/isc/assertions.c	1
lib/isc/mem.c	15
lib/isc/./jemalloc_shim.h	4
lib/isc/string.c	3
lib/isc/error.c	2
lib/isc/hash.c	2
lib/isc/siphash.c	1
lib/isc/./include/isc/ascii.h	2
lib/dns/callbacks.c	4
lib/isc/log.c	11
lib/isc/rwlock.c	7
lib/isc/time.c	10
lib/isc/file.c	4
lib/isc/errno2result.c	1
lib/isc/result.c	1
lib/isc/dir.c	5
lib/isc/errno.c	1
lib/isc/stdio.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/dns/./rdata/in_1/a_1.c	2
lib/dns/./rdata/ch_3/a_1.c	2
lib/dns/./include/dns/compress.h	2
lib/dns/name.c	15
lib/dns/./rdata/hs_4/a_1.c	2
lib/dns/./rdata/generic/ns_2.c	2
lib/dns/./rdata/generic/md_3.c	2
lib/dns/./rdata/generic/mf_4.c	2
lib/dns/./rdata/generic/cname_5.c	2
lib/dns/./rdata/generic/soa_6.c	2
lib/dns/./rdata/generic/mb_7.c	2
lib/dns/./rdata/generic/mg_8.c	2
lib/dns/./rdata/generic/mr_9.c	2
lib/dns/./rdata/generic/null_10.c	2
lib/dns/./rdata/in_1/wks_11.c	2
lib/dns/./rdata/generic/ptr_12.c	2
lib/dns/./rdata/generic/hinfo_13.c	2
lib/dns/./rdata/generic/minfo_14.c	2
lib/dns/./rdata/generic/mx_15.c	2
lib/dns/./rdata/generic/txt_16.c	4
lib/dns/./rdata/generic/rp_17.c	2
lib/dns/./rdata/generic/afsdb_18.c	2
lib/dns/./rdata/generic/x25_19.c	2
lib/dns/./rdata/generic/isdn_20.c	2
lib/dns/./rdata/generic/rt_21.c	2
lib/dns/./rdata/in_1/nsap_22.c	2
lib/dns/./rdata/in_1/nsap-ptr_23.c	2
lib/dns/./rdata/generic/sig_24.c	2
lib/dns/fixedname.c	3
lib/dns/./rdata/generic/key_25.c	5
lib/dns/./rdata/in_1/px_26.c	2
lib/dns/./rdata/generic/gpos_27.c	2
lib/dns/./rdata/in_1/aaaa_28.c	2
lib/dns/./rdata/generic/loc_29.c	2
lib/dns/./rdata/generic/nxt_30.c	2
lib/dns/./rdata/in_1/eid_31.c	2
lib/dns/./rdata/in_1/nimloc_32.c	2
lib/dns/./rdata/in_1/srv_33.c	2
lib/dns/./rdata/in_1/atma_34.c	2
lib/dns/./rdata/generic/naptr_35.c	3
lib/isc/regex.c	1
lib/dns/./rdata/in_1/kx_36.c	2
lib/dns/./rdata/generic/cert_37.c	2
lib/dns/./rdata/in_1/a6_38.c	2
lib/dns/./rdata/generic/dname_39.c	2
lib/dns/./rdata/generic/sink_40.c	2
lib/dns/./rdata/generic/opt_41.c	2
lib/isc/utf8.c	2
lib/dns/./rdata/in_1/apl_42.c	2
lib/dns/./rdata/generic/ds_43.c	4
lib/isc/md.c	1
lib/dns/./rdata/generic/sshfp_44.c	2
lib/dns/./rdata/generic/ipseckey_45.c	2
lib/dns/./rdata/generic/rrsig_46.c	2
lib/dns/./rdata/generic/nsec_47.c	2
lib/dns/./rdata/generic/dnskey_48.c	2
lib/dns/./rdata/in_1/dhcid_49.c	2
lib/dns/./rdata/generic/nsec3_50.c	2
lib/dns/./rdata/generic/nsec3param_51.c	2
lib/dns/./rdata/generic/tlsa_52.c	4
lib/dns/./rdata/generic/smimea_53.c	2
lib/dns/./rdata/generic/hip_55.c	2
lib/dns/./rdata/generic/ninfo_56.c	2
lib/dns/./rdata/generic/rkey_57.c	2
lib/dns/./rdata/generic/talink_58.c	2
lib/dns/./rdata/generic/cds_59.c	2
lib/dns/./rdata/generic/cdnskey_60.c	2
lib/dns/./rdata/generic/openpgpkey_61.c	2
lib/dns/./rdata/generic/csync_62.c	2
lib/dns/./rdata/generic/zonemd_63.c	2
lib/dns/./rdata/in_1/svcb_64.c	6
lib/dns/./rdata/in_1/https_65.c	2
lib/dns/./rdata/generic/spf_99.c	2
lib/dns/./rdata/generic/nid_104.c	2
lib/dns/./rdata/generic/l32_105.c	2
lib/dns/./rdata/generic/l64_106.c	2
lib/dns/./rdata/generic/lp_107.c	2
lib/dns/./rdata/generic/eui48_108.c	2
lib/dns/./rdata/generic/eui64_109.c	2
lib/dns/./rdata/generic/tkey_249.c	2
lib/dns/./rdata/any_255/tsig_250.c	2
lib/dns/./rdata/generic/uri_256.c	2
lib/dns/./rdata/generic/caa_257.c	2
lib/dns/./rdata/generic/avc_258.c	2
lib/dns/./rdata/generic/doa_259.c	2
lib/dns/./rdata/generic/amtrelay_260.c	2
lib/dns/./rdata/generic/ta_32768.c	2
lib/dns/./rdata/generic/dlv_32769.c	2
lib/dns/./rdata/generic/keydata_65533.c	2
lib/isc/hex.c	2
lib/isc/./include/isc/buffer.h	5
lib/dns/../../lib/isc/include/isc/ascii.h	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/dns/ttl.c	2
lib/dns/time.c	2
lib/isc/stdtime.c	1
lib/isc/serial.c	1
lib/isc/base64.c	2
lib/dns/rcode.c	6
lib/dns/key.c	1
lib/isc/base32.c	3
lib/isc/lex.c	2
lib/dns/masterdump.c	1
lib/dns/compress.c	2

Fuzzer: dns_master_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1353	40.7%
gold	[1:9]	87	2.62%
yellow	[10:29]	64	1.92%
greenyellow	[30:49]	39	1.17%
lawngreen	50+	1777	53.5%
All colors	3320	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2605	2665	12 : View List ['isc_rwlock_trywrlock', 'is_leaf', 'isc_rwlock_rdunlock', 'send_to_prune_tree', 'isc_rwlock_wrlock', 'isc_rwlock_tryupgrade', 'isc_error_fatal', 'isc_rwlock_wrunlock', 'clean_zone_node', 'delete_node', 'isc_rwlock_rdlock', 'clean_cache_node']	2657	2717	decrement_reference	call site: 00000	/src/bind9/lib/dns/rbtdb.c:2030
1903	1903	1 : View List ['closeversion']	1903	1903	zone_findrdataset	call site: 00000	/src/bind9/lib/dns/rbtdb.c:5918
1381	22471	51 : View List ['isc_buffer_init.7867', 'dns_rdatalist_init', 'dns_name_fromtext', 'is_glue', 'dns_rdatatype_fromtext', 'isc__mem_strdup', 'strcasecmp', 'dns_rdata_checkowner', 'isc_stdtime_now', 'dns_rdatatype_atparent', 'pushfile', 'strncasecmp', 'dns_name_format', 'dns_rdata_checksvcb', 'dns_rdata_tostruct', 'isc_result_totext', 'isc_lex_getsourceline', 'isc_error_fatal', 'isc_lex_close', 'find_free_name', 'limit_ttl', 'isc_lex_ungettoken', 'grow_rdata', 'isc_lex_getsourcename', 'dns_rdataclass_fromtext', 'dns_name_issubdomain', 'gettoken', 'dns_soa_getminimum', 'check_wildcard', 'isc_error_unexpected', 'dns_master_isprimary', 'isc_lex_isfile', 'dns_rdata_init', 'isc_buffer_setactive.7911', 'dns_time64_fromtext', 'dns_fixedname_initname', 'dns_rdataclass_format', 'check_ns', 'dns_rdatatype_ismeta', 'generate', 'dns_rdatatype_format', 'dns_name_isdnssd', 'dns_name_caseequal', 'dns_ttl_fromtext', 'incctx_destroy', 'isc_serial_lt', 'dns_rdata_covers', 'grow_rdatalist', 'dns_name_equal', 'isc_buffer_add.7857', 'dns_rdata_fromtext']	1429	29567	load_text	call site: 00882	/src/bind9/lib/dns/master.c:1099
372	582	29 : View List ['strlcpy', 'isc_rwlock_rdunlock', 'isc_log_wouldlog', 'fflush', 'isc_time_subtract', 'isc__mem_put', 'isc_rwlock_rdlock', 'isc__mem_get', 'fstat', 'strlen', 'isc_time_compare', 'stat', 'pthread_mutex_lock', 'isc_time_formatISO8601ms', 'isc_time_set', 'isc_time_formattimestamp', 'syslog', 'isc_assertion_failed', 'isc_result_totext', '__errno_location', 'isc_error_fatal', 'isc_time_now', 'pthread_mutex_unlock', 'isc_string_strerror_r', 'fileno', 'strcmp', 'isc_log_open', 'isc_time_formatISO8601Lms', 'fclose']	372	582	isc_log_doit	call site: 00020	/src/bind9/lib/isc/log.c:1524
188	188	1 : View List ['warn_badname']	188	1002	generic_fromtext_in_svcb	call site: 02697	/src/bind9/lib/dns/./rdata/in_1/svcb_64.c:617
188	188	1 : View List ['warn_badname']	188	188	fromtext_afsdb	call site: 02385	/src/bind9/lib/dns/./rdata/generic/afsdb_18.c:62
188	188	1 : View List ['warn_badname']	188	188	fromtext_mx	call site: 02369	/src/bind9/lib/dns/./rdata/generic/mx_15.c:93
188	188	1 : View List ['warn_badname']	188	188	fromtext_ns	call site: 02264	/src/bind9/lib/dns/./rdata/generic/ns_2.c:48
188	188	1 : View List ['warn_badname']	188	188	fromtext_rt	call site: 02394	/src/bind9/lib/dns/./rdata/generic/rt_21.c:57
188	188	1 : View List ['warn_badname']	188	188	fromtext_in_a6	call site: 02568	/src/bind9/lib/dns/./rdata/in_1/a6_38.c:93
159	163	2 : View List ['dns_rbt_deletenode', 'isc_result_totext']	159	597	loadnode	call site: 00000	/src/bind9/lib/dns/rbtdb.c:7457
128	200	3 : View List ['mark_header_ancient', 'resign_delete', 'set_ttl']	364	555	add32	call site: 00000	/src/bind9/lib/dns/rbtdb.c:6601

Runtime coverage analysis

Covered functions

638

Functions that are reachable but not covered

322

Reachable functions

753

Percentage of reachable functions covered

57.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/dns_master_load.c	1
fuzz/../lib/isc/include/isc/buffer.h	3
lib/isc/assertions.c	1
lib/dns/callbacks.c	4
lib/isc/log.c	12
lib/isc/rwlock.c	14
lib/isc/string.c	3
lib/isc/error.c	2
lib/isc/time.c	10
lib/isc/mem.c	23
lib/isc/hash.c	3
lib/isc/siphash.c	2
lib/isc/./include/isc/ascii.h	3
lib/isc/./jemalloc_shim.h	4
lib/isc/file.c	4
lib/isc/errno2result.c	1
lib/isc/result.c	1
lib/isc/dir.c	5
lib/isc/errno.c	1
lib/isc/stdio.c	3
lib/isc/os.c	1
lib/dns/db.c	7
lib/dns/rbtdb.c	13
lib/dns/name.c	30
lib/dns/stats.c	7
lib/isc/stats.c	5
lib/isc/heap.c	5
lib/dns/rbt.c	22
lib/dns/../../lib/isc/include/isc/hash.h	1
lib/isc/async.c	1
lib/dns/../../lib/isc/include/isc/buffer.h	23
lib/isc/loop.c	2
lib/dns/rdataslab.c	1
lib/dns/rdataset.c	4
lib/dns/fixedname.c	3
lib/dns/../../lib/isc/include/isc/ascii.h	6
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
lib/dns/master.c	28
lib/isc/lex.c	18
lib/isc/./include/isc/buffer.h	16
lib/isc/parseint.c	2
lib/dns/rdatalist.c	2
lib/dns/rdata.c	47
lib/dns/./rdata/in_1/a_1.c	4
lib/dns/./rdata/ch_3/a_1.c	4
lib/dns/./rdata/hs_4/a_1.c	4
lib/dns/./rdata/generic/ns_2.c	4
lib/dns/./rdata/generic/md_3.c	4
lib/dns/./rdata/generic/mf_4.c	4
lib/dns/./rdata/generic/cname_5.c	4
lib/dns/./rdata/generic/soa_6.c	4
lib/dns/./rdata/generic/mb_7.c	4
lib/dns/./rdata/generic/mg_8.c	4
lib/dns/./rdata/generic/mr_9.c	4
lib/dns/./rdata/generic/null_10.c	4
lib/dns/./rdata/in_1/wks_11.c	7
lib/dns/./rdata/generic/ptr_12.c	4
lib/dns/./rdata/generic/hinfo_13.c	4
lib/dns/./rdata/generic/minfo_14.c	4
lib/dns/./rdata/generic/mx_15.c	5
lib/dns/./rdata/generic/txt_16.c	7
lib/dns/./rdata/generic/rp_17.c	4
lib/dns/./rdata/generic/afsdb_18.c	4
lib/dns/./rdata/generic/x25_19.c	4
lib/dns/./rdata/generic/isdn_20.c	4
lib/dns/./rdata/generic/rt_21.c	4
lib/dns/./rdata/in_1/nsap_22.c	4
lib/dns/./rdata/in_1/nsap-ptr_23.c	4
lib/dns/./rdata/generic/sig_24.c	5
lib/dns/./rdata/generic/key_25.c	8
lib/dns/./rdata/in_1/px_26.c	4
lib/dns/./rdata/generic/gpos_27.c	4
lib/dns/./rdata/in_1/aaaa_28.c	4
lib/dns/./rdata/generic/loc_29.c	19
lib/dns/./rdata/generic/nxt_30.c	4
lib/dns/./rdata/in_1/eid_31.c	4
lib/dns/./rdata/in_1/nimloc_32.c	4
lib/dns/./rdata/in_1/srv_33.c	4
lib/dns/./rdata/in_1/atma_34.c	4
lib/dns/./rdata/generic/naptr_35.c	5
lib/dns/./rdata/in_1/kx_36.c	4
lib/dns/./rdata/generic/cert_37.c	4
lib/dns/./rdata/in_1/a6_38.c	4
lib/dns/./rdata/generic/dname_39.c	4
lib/dns/./rdata/generic/sink_40.c	4
lib/dns/./rdata/generic/opt_41.c	4
lib/dns/./rdata/in_1/apl_42.c	4
lib/dns/./rdata/generic/ds_43.c	7
lib/dns/./rdata/generic/sshfp_44.c	4
lib/dns/./rdata/generic/ipseckey_45.c	4
lib/dns/./rdata/generic/rrsig_46.c	5
lib/dns/./rdata/generic/nsec_47.c	4
lib/dns/./rdata/generic/dnskey_48.c	4
lib/dns/./rdata/in_1/dhcid_49.c	4
lib/dns/./rdata/generic/nsec3_50.c	4
lib/dns/./rdata/generic/nsec3param_51.c	4
lib/dns/./rdata/generic/tlsa_52.c	7
lib/dns/./rdata/generic/smimea_53.c	4
lib/dns/./rdata/generic/hip_55.c	4
lib/dns/./rdata/generic/ninfo_56.c	4
lib/dns/./rdata/generic/rkey_57.c	4
lib/dns/./rdata/generic/talink_58.c	4
lib/dns/./rdata/generic/cds_59.c	4
lib/dns/./rdata/generic/cdnskey_60.c	4
lib/dns/./rdata/generic/openpgpkey_61.c	4
lib/dns/./rdata/generic/csync_62.c	4
lib/dns/./rdata/generic/zonemd_63.c	4
lib/dns/./rdata/in_1/svcb_64.c	14
lib/dns/./rdata/in_1/https_65.c	4
lib/dns/./rdata/generic/spf_99.c	4
lib/dns/./rdata/generic/nid_104.c	4
lib/dns/./rdata/generic/l32_105.c	4
lib/dns/./rdata/generic/l64_106.c	4
lib/dns/./rdata/generic/lp_107.c	4
lib/dns/./rdata/generic/eui48_108.c	4
lib/dns/./rdata/generic/eui64_109.c	4
lib/dns/./rdata/generic/tkey_249.c	4
lib/dns/./rdata/any_255/tsig_250.c	4
lib/dns/./rdata/generic/uri_256.c	4
lib/dns/./rdata/generic/caa_257.c	4
lib/dns/./rdata/generic/avc_258.c	4
lib/dns/./rdata/generic/doa_259.c	4
lib/dns/./rdata/generic/amtrelay_260.c	4
lib/dns/./rdata/generic/ta_32768.c	4
lib/dns/./rdata/generic/dlv_32769.c	4
lib/dns/./rdata/generic/keydata_65533.c	4
lib/isc/serial.c	2
lib/dns/ttl.c	3
lib/isc/stdtime.c	1
lib/dns/time.c	2
lib/dns/rcode.c	14
lib/isc/hex.c	6
lib/dns/./include/dns/compress.h	2
lib/isc/regex.c	1
lib/isc/utf8.c	2
lib/isc/md.c	1
lib/isc/base64.c	6
lib/isc/base32.c	7
lib/dns/soa.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
rdataset_addglue	/src/bind9/lib/dns/rbtdb.c	3	['struct.dns_rdataset *', 'char *', 'struct.dns_message *']	13	0	357	42	8	482	0	2756	785
isc_nm_listenhttp	/src/bind9/lib/isc/netmgr/http.c	9	['struct.isc_nm.5430 *', 'int ', 'struct.isc_sockaddr *', 'int ', 'struct.isc_quota *', 'struct.ssl_ctx_st *', 'struct.isc_nm_http_endpoints.5449 *', 'int ', 'struct.isc_nmsocket.5483 **']	109	0	222	25	4	578	0	2956	464
addrdataset	/src/bind9/lib/dns/rbtdb.c	7	['struct.dns_db *', 'char *', 'char *', 'int ', 'struct.dns_rdataset *', 'int ', 'struct.dns_rdataset *']	6	0	1386	221	39	469	0	2598	358
opensslecdsa_parse	/src/bind9/lib/dns/opensslecdsa_link.c	3	['struct.dst_key *', 'struct.isc_lex *', 'struct.dst_key *']	6	0	344	47	15	203	0	1113	273
dns_rrl	/src/bind9/lib/dns/rrl.c	12	['struct.dns_view *', 'struct.dns_zone *', 'struct.isc_sockaddr *', 'N/A', 'N/A', 'N/A', 'struct.dns_name *', 'int ', 'int ', 'N/A', 'char *', 'int ']	6	0	832	111	31	171	0	1072	223
zone_load	/src/bind9/lib/dns/zone.c	3	['struct.dns_zone *', 'int ', 'N/A']	140	0	1250	222	66	3759	11	28299	213
dns_dlz_writeablezone	/src/bind9/lib/dns/dlz.c	3	['struct.dns_view *', 'struct.dns_dlzdb *', 'char *']	154	0	250	39	11	3767	0	27378	154

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3857 / 5290

Cyclomatic complexity statically reachable by fuzzers

30226 / 37682

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
isc_buffer_reserve	32	7	21.87%	['isc_lex_getmastertoken_fuzzer', 'isc_lex_gettoken_fuzzer', 'dns_qpkey_name_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
isc_log_doit	267	23	8.614%	['dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
totext_ctx_init	70	24	34.28%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_message_renderend	109	46	42.20%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_message_headertotext	168	80	47.61%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
totext_keydata	129	12	9.302%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer']
dst_key_sigsize	49	11	22.44%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
journal_open	92	26	28.26%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_name_downcase	39	17	43.58%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dst__openssl_init	32	7	21.87%	[]
opensslrsa_build_pkey	65	28	43.07%	[]
opensslrsa_createctx	51	22	43.13%	[]
dns_qpmulti_commit	42	23	54.76%	[]
dns_qp_findname_parent	71	38	53.52%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
reclaim_chunks	35	11	31.42%	[]
dns__rbt_findnode	244	103	42.21%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_rbtnodechain_next	68	25	36.76%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
add32	382	139	36.38%	[]
update_rrsetstats	35	11	31.42%	[]
decrement_reference	97	26	26.80%	[]
zone_find	323	142	43.96%	[]
activeempty	49	21	42.85%	[]
closeversion	168	23	13.69%	[]
findnodeintree	51	18	35.29%	[]
detachnode	47	24	51.06%	[]
dns_rrl_view_destroy	41	10	24.39%	[]
tsig_log	32	8	25.0%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_view_create	109	58	53.21%	[]
dns_view_detach	86	42	48.83%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_view_find	179	63	35.19%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_view_simplefind	33	17	51.51%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_view_setnewzones	35	13	37.14%	[]
dns_zone_cdscheck	166	32	19.27%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
dns_zone_verifydb	39	11	28.20%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
zone_load	219	78	35.61%	[]
get_primary_options	41	18	43.90%	[]
zone_shutdown	86	44	51.16%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
check_nsec3param	90	27	30.0%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
zone_postload	469	130	27.71%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
zone_journal_rollforward	68	17	25.0%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
zone_check_dnskeys	53	24	45.28%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
isc___errno2result	94	12	12.76%	['isc_lex_getmastertoken_fuzzer', 'isc_lex_gettoken_fuzzer', 'dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
isc_file_openuniquemode	52	26	50.0%	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']
_clear_radix	36	5	13.88%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/bind9/lib/dns/name.c	['dns_name_fromtext_target_fuzzer', 'dns_name_fromwire_fuzzer', 'dns_qpkey_name_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_name_fromtext_target_fuzzer', 'dns_name_fromwire_fuzzer', 'dns_qpkey_name_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/journal.c	[]	[]
/src/bind9/fuzz/dns_name_fromwire.c	['dns_name_fromwire_fuzzer']	['dns_name_fromwire_fuzzer']
/src/bind9/lib/dns/./rdata/in_1/svcb_64.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/txt_16.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/dnssec.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/fuzz/isc_lex_gettoken.c	['isc_lex_gettoken_fuzzer']	['isc_lex_gettoken_fuzzer']
/src/bind9/lib/isc/./include/isc/ascii.h	['isc_lex_getmastertoken_fuzzer', 'isc_lex_gettoken_fuzzer', 'dns_qpkey_name_fuzzer', 'dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/isc/sockaddr.c	['dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/lib/dns/./rdata/generic/smimea_53.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/hs_4/a_1.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/ds.c	[]	[]
/src/bind9/lib/isc/dir.c	['dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/isc/errno.c	['dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/zone.c	['dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/lib/dns/./rdata/generic/keydata_65533.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/rdatalist.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/./rdata/generic/zonemd_63.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/isc/utf8.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_message_parse_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/isc/tid.c	[]	[]
/src/bind9/lib/isc/./include/isc/hash.h	['dns_message_checksig_fuzzer']	[]
/src/bind9/lib/dns/./rdata/in_1/dhcid_49.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/callbacks.c	['dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/isc/stdio.c	['dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/rbt.c	['dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']	['dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/./rdata/generic/cert_37.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/isc/./include/isc/dnsstream.h	['dns_message_checksig_fuzzer']	[]
/src/bind9/lib/isc/nonce.c	[]	[]
/src/bind9/lib/dns/./rdata/generic/mg_8.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/afsdb_18.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/isc/errno2result.c	['isc_lex_getmastertoken_fuzzer', 'isc_lex_gettoken_fuzzer', 'dns_qp_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_message_checksig_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/masterdump.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer']	['dns_message_parse_fuzzer', 'dns_rdata_fromwire_text_fuzzer']
/src/bind9/lib/isc/base32.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_message_parse_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/./rdata/generic/dname_39.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/dispatch.c	['dns_message_checksig_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/key_25.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/fuzz/dns_master_load.c	['dns_master_load_fuzzer']	['dns_master_load_fuzzer']
/src/bind9/lib/dns/rrl.c	[]	[]
/src/bind9/lib/isc/netmgr/netmgr.c	['dns_message_checksig_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/eui48_108.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/rriterator.c	[]	[]
/src/bind9/lib/isc/hex.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']
/src/bind9/lib/dns/./rdata/generic/md_3.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/rp_17.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/in_1/a6_38.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/hmac_link.c	[]	[]
/src/bind9/lib/dns/./rdata/generic/nsec_47.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/sig_24.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/resolver.c	['dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/lib/dns/qp.c	['dns_qpkey_name_fuzzer', 'dns_qp_fuzzer', 'dns_message_checksig_fuzzer']	['dns_qpkey_name_fuzzer', 'dns_qp_fuzzer', 'dns_message_checksig_fuzzer']
/src/bind9/lib/dns/openssl_link.c	[]	[]
/src/bind9/lib/isc/radix.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/lib/isc/work.c	[]	[]
/src/bind9/lib/isc/timer.c	['dns_message_checksig_fuzzer']	[]
/src/bind9/lib/isc/net.c	[]	[]
/src/bind9/lib/isc/safe.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer']	['dns_message_checksig_fuzzer']
/src/bind9/lib/dns/./rdata/generic/dlv_32769.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/compress.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromwire_text_fuzzer']	['dns_message_parse_fuzzer', 'dns_rdata_fromwire_text_fuzzer']
/src/bind9/lib/dns/./include/dns/compress.h	['dns_name_fromwire_fuzzer', 'dns_qpkey_name_fuzzer', 'dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/in_1/wks_11.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/tlsa_52.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_fuzzer', 'dns_master_load_fuzzer']	[]
/src/bind9/lib/dns/./rdata/generic/cdnskey_60.c	['dns_message_parse_fuzzer', 'dns_message_checksig_fuzzer', 'dns_rdata_fromtext_fuzzer', 'dns_rdata_fromwire_text_