High level conclusions

Fuzzer fuzz_disas_ext-bfd_arch_mips is blocked:

The runtime code coverage of fuzz_disas_ext-bfd_arch_mips covers 4.873% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_readelf_elf32_littlearm is blocked:

The runtime code coverage of fuzz_readelf_elf32_littlearm covers 2.985% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_readelf_elf32_bigarm is blocked:

The runtime code coverage of fuzz_readelf_elf32_bigarm covers 2.985% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_nm is blocked:

The runtime code coverage of fuzz_nm covers 29.45% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_addr2line is blocked:

The runtime code coverage of fuzz_addr2line covers 26.45% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_readelf_elf64_mmix is blocked:

The runtime code coverage of fuzz_readelf_elf64_mmix covers 2.985% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_disas_ext-bfd_arch_mep is blocked:

The runtime code coverage of fuzz_disas_ext-bfd_arch_mep covers 4.592% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_readelf_elf32_csky is blocked:

The runtime code coverage of fuzz_readelf_elf32_csky covers 1.492% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_disas_ext-bfd_arch_csky is blocked:

The runtime code coverage of fuzz_disas_ext-bfd_arch_csky covers 1.218% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_disas_ext-bfd_arch_arm is blocked:

The runtime code coverage of fuzz_disas_ext-bfd_arch_arm covers 1.593% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 27.69% of cyclomatic complexity.

Fuzzers reach 19.71% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2524 / 12803

Cyclomatic complexity statically reachable by fuzzers

41279 / 149037

Runtime code coverage of functions

3905 / 12803

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_disas_ext-bfd_arch_arm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7007	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	18	0.25%
All colors	7025	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
62	62	1 : View List ['mapping_symbol_for_insn']	62	62	find_ifthen_state	call site: 00000	/src/binutils-gdb/opcodes/arm-dis.c:12354
10	10	1 : View List ['mant_bits_set']	10	10	floatformat_to_double	call site: 02220	/src/binutils-gdb/libiberty/./floatformat.c:504
2	2	1 : View List ['abort']	2	2	arm_decode_field	call site: 00000	/src/binutils-gdb/opcodes/arm-dis.c:5608
2	2	1 : View List ['abort']	2	2	arm_decode_field_multiple	call site: 00000	/src/binutils-gdb/opcodes/arm-dis.c:5628
0	0	None	60	60	_bfd_doprnt_scan	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1251
0	0	None	60	60	_bfd_doprnt_scan	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1273
0	0	None	60	60	_bfd_doprnt_scan	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1295
0	0	None	56	56	_bfd_doprnt	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1007
0	0	None	56	56	_bfd_doprnt	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1013
0	0	None	56	56	_bfd_doprnt	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1041
0	0	None	56	56	_bfd_doprnt	call site: 00000	/src/binutils-gdb/bfd/bfd.c:1063
0	0	None	14	64	print_insn_neon	call site: 00000	/src/binutils-gdb/opcodes/arm-dis.c:9686

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

1050

Reachable functions

1067

Percentage of reachable functions covered

1.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_disas_ext.c	4
opcodes/dis-init.c	1
bfd/libbfd.c	12
bfd/./archures.c	4
opcodes/./disassemble.c	5
opcodes/alpha-dis.c	1
opcodes/arc-dis.c	1
opcodes/arc-ext.c	3
opcodes/../bfd/bfd.h	8
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
bfd/section.c	5
bfd/./bfd.h	7
bfd/bfd.c	5
libiberty/./xstrdup.c	1
opcodes/avr-dis.c	3
opcodes/bfin-dis.c	51
opcodes/cr16-dis.c	22
opcodes/cris-dis.c	20
opcodes/crx-dis.c	19
opcodes/csky-dis.c	1
bfd/hash.c	4
libiberty/./objalloc.c	2
opcodes/d10v-dis.c	4
opcodes/d10v-opc.c	1
opcodes/d30v-dis.c	4
opcodes/d30v-opc.c	1
opcodes/dlx-dis.c	8
opcodes/h8300-dis.c	7
opcodes/hppa-dis.c	20
opcodes/../bfd/libhppa.h	2
opcodes/i386-dis.c	32
opcodes/ia64-dis.c	2
opcodes/ia64-opc.c	8
opcodes/ip2k-dis.c	15
opcodes/cgen-bitset.c	10
opcodes/ip2k-desc.c	8
opcodes/ip2k-opc.c	8
opcodes/ip2k-asm.c	1
libiberty/./regex.c	15
opcodes/ip2k-ibld.c	9
opcodes/cgen-opc.c	9
opcodes/cgen-dis.c	6
opcodes/bpf-dis.c	4
opcodes/bpf-opc.c	7
opcodes/epiphany-dis.c	12
opcodes/epiphany-desc.c	8
opcodes/epiphany-opc.c	6
opcodes/epiphany-asm.c	1
opcodes/epiphany-ibld.c	9
opcodes/fr30-dis.c	15
opcodes/fr30-desc.c	8
opcodes/fr30-opc.c	6
opcodes/fr30-asm.c	1
opcodes/fr30-ibld.c	12
opcodes/kvx-dis.c	11
opcodes/lm32-dis.c	9
opcodes/lm32-desc.c	8
opcodes/lm32-opc.c	6
opcodes/lm32-asm.c	1
opcodes/lm32-ibld.c	9
opcodes/m32r-dis.c	12
opcodes/m32r-desc.c	8
opcodes/m32r-opc.c	7
opcodes/m32r-asm.c	1
opcodes/m32r-ibld.c	9
opcodes/m68hc11-dis.c	7
opcodes/s12z-dis.c	7
opcodes/s12z-opc.c	2
opcodes/m68k-dis.c	12
bfd/cpu-m68k.c	1
libiberty/./floatformat.c	3
opcodes/mt-dis.c	10
opcodes/mt-desc.c	8
opcodes/mt-opc.c	8
opcodes/mt-asm.c	1
opcodes/mt-ibld.c	9
opcodes/microblaze-dis.c	9
opcodes/msp430-dis.c	11
opcodes/nds32-dis.c	16
libiberty/./hashtab.c	12
opcodes/nfp-dis.c	51
opcodes/./../include/dis-asm.h	1
opcodes/ns32k-dis.c	13
opcodes/mcore-dis.c	1
opcodes/mep-dis.c	17
opcodes/mep-desc.c	8
opcodes/mep-opc.c	8
opcodes/mep-asm.c	1
opcodes/mep-ibld.c	9
opcodes/metag-dis.c	1
opcodes/mips-dis.c	29
bfd/elfxx-mips.c	1
opcodes/./../include/opcode/mips.h	8
opcodes/mips16-opc.c	1
opcodes/micromips-opc.c	1
opcodes/mips-opc.c	1
opcodes/mmix-dis.c	5
opcodes/m10200-dis.c	2
opcodes/m10300-dis.c	2
opcodes/nios2-dis.c	10
opcodes/or1k-dis.c	10
opcodes/or1k-desc.c	8
opcodes/or1k-opc.c	7
opcodes/or1k-asm.c	1
opcodes/or1k-ibld.c	9
opcodes/pdp11-dis.c	7
opcodes/pj-dis.c	2
opcodes/ppc-dis.c	8
opcodes/pru-dis.c	5
opcodes/riscv-dis.c	3
bfd/cpu-riscv.c	2
bfd/elfxx-riscv.c	16
opcodes/rl78-dis.c	8
opcodes/rl78-decode.opc	3
opcodes/rx-dis.c	12
opcodes/rx-decode.opc	3
opcodes/s390-dis.c	7
opcodes/score-dis.c	7
opcodes/score7-dis.c	4
opcodes/./sh-dis.c	5
bfd/cpu-sh.c	1
opcodes/sparc-dis.c	5
opcodes/sparc-opc.c	5
opcodes/spu-dis.c	3
opcodes/tic30-dis.c	9
opcodes/tic4x-dis.c	15
opcodes/tic54x-dis.c	12
opcodes/tic6x-dis.c	7
opcodes/ft32-dis.c	4
opcodes/./../include/opcode/ft32.h	1
opcodes/v850-dis.c	11
opcodes/wasm32-dis.c	7
opcodes/xgate-dis.c	6
opcodes/xstormy16-dis.c	8
opcodes/xstormy16-desc.c	8
opcodes/xstormy16-opc.c	6
opcodes/xstormy16-asm.c	1
opcodes/xstormy16-ibld.c	9
opcodes/xtensa-dis.c	6
bfd/xtensa-isa.c	29
bfd/xtensa-dynconfig.c	1
bfd/elf32-xtensa.c	19
bfd/compress.c	3
bfd/bfdio.c	5
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/elflink.c	3
bfd/elf.c	2
opcodes/z80-dis.c	4
opcodes/z8k-dis.c	10
opcodes/vax-dis.c	7
opcodes/visium-dis.c	6
opcodes/frv-dis.c	13
opcodes/frv-desc.c	8
opcodes/frv-opc.c	6
opcodes/frv-asm.c	1
opcodes/frv-ibld.c	9
opcodes/moxie-dis.c	1
opcodes/iq2000-dis.c	9
opcodes/iq2000-desc.c	8
opcodes/iq2000-opc.c	6
opcodes/iq2000-asm.c	2
opcodes/iq2000-ibld.c	9
opcodes/m32c-dis.c	23
opcodes/m32c-desc.c	8
opcodes/m32c-opc.c	7
opcodes/m32c-asm.c	2
opcodes/m32c-ibld.c	12
opcodes/tilegx-dis.c	1
opcodes/tilegx-opc.c	4
opcodes/tilepro-dis.c	2
opcodes/tilepro-opc.c	4
opcodes/loongarch-dis.c	7
opcodes/loongarch-coder.c	6
opcodes/loongarch-opc.c	1

Fuzzer: fuzz_disas_ext-bfd_arch_csky

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7008	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	0.24%
All colors	7025	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	1 : View List ['bfd_get_section_by_name']	65	65	csky_get_disassembler	call site: 00548	/src/binutils-gdb/opcodes/csky-dis.c:242
44	44	1 : View List ['floatformat_to_double']	46	46	csky_output_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:547
10	43	2 : View List ['get_gr_name', 'strcat']	10	43	csky_output_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:898
2	159	3 : View List ['csky_find_inst_info', 'csky_print_operands', 'strcat']	2	159	print_insn_csky	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:1202
0	0	None	46	50	csky_output_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:535
0	0	None	12	45	csky_output_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:895
0	0	None	12	12	xmalloc	call site: 00019	/src/binutils-gdb/libiberty/./xmalloc.c:147
0	0	None	11	168	print_insn_csky	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:1073
0	0	2 : View List ['bfd_asymbol_value.4306', 'get_sym_code_type.4304']	11	168	print_insn_csky	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:1081
0	0	None	6	276	csky_print_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:955
0	0	None	2	159	print_insn_csky	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:1195
0	0	None	2	2	csky_output_operand	call site: 00000	/src/binutils-gdb/opcodes/csky-dis.c:927

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

1054

Reachable functions

1067

Percentage of reachable functions covered

1.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_disas_ext.c	4
opcodes/dis-init.c	1
bfd/libbfd.c	12
bfd/./archures.c	4
opcodes/./disassemble.c	5
opcodes/alpha-dis.c	1
opcodes/arc-dis.c	1
opcodes/arc-ext.c	3
opcodes/../bfd/bfd.h	8
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
bfd/section.c	5
bfd/./bfd.h	7
bfd/bfd.c	5
libiberty/./xstrdup.c	1
opcodes/avr-dis.c	3
opcodes/bfin-dis.c	51
opcodes/cr16-dis.c	22
opcodes/cris-dis.c	20
opcodes/crx-dis.c	19
opcodes/csky-dis.c	1
bfd/hash.c	4
libiberty/./objalloc.c	2
opcodes/d10v-dis.c	4
opcodes/d10v-opc.c	1
opcodes/d30v-dis.c	4
opcodes/d30v-opc.c	1
opcodes/dlx-dis.c	8
opcodes/h8300-dis.c	7
opcodes/hppa-dis.c	20
opcodes/../bfd/libhppa.h	2
opcodes/i386-dis.c	32
opcodes/ia64-dis.c	2
opcodes/ia64-opc.c	8
opcodes/ip2k-dis.c	15
opcodes/cgen-bitset.c	10
opcodes/ip2k-desc.c	8
opcodes/ip2k-opc.c	8
opcodes/ip2k-asm.c	1
libiberty/./regex.c	15
opcodes/ip2k-ibld.c	9
opcodes/cgen-opc.c	9
opcodes/cgen-dis.c	6
opcodes/bpf-dis.c	4
opcodes/bpf-opc.c	7
opcodes/epiphany-dis.c	12
opcodes/epiphany-desc.c	8
opcodes/epiphany-opc.c	6
opcodes/epiphany-asm.c	1
opcodes/epiphany-ibld.c	9
opcodes/fr30-dis.c	15
opcodes/fr30-desc.c	8
opcodes/fr30-opc.c	6
opcodes/fr30-asm.c	1
opcodes/fr30-ibld.c	12
opcodes/kvx-dis.c	11
opcodes/lm32-dis.c	9
opcodes/lm32-desc.c	8
opcodes/lm32-opc.c	6
opcodes/lm32-asm.c	1
opcodes/lm32-ibld.c	9
opcodes/m32r-dis.c	12
opcodes/m32r-desc.c	8
opcodes/m32r-opc.c	7
opcodes/m32r-asm.c	1
opcodes/m32r-ibld.c	9
opcodes/m68hc11-dis.c	7
opcodes/s12z-dis.c	7
opcodes/s12z-opc.c	2
opcodes/m68k-dis.c	12
bfd/cpu-m68k.c	1
libiberty/./floatformat.c	3
opcodes/mt-dis.c	10
opcodes/mt-desc.c	8
opcodes/mt-opc.c	8
opcodes/mt-asm.c	1
opcodes/mt-ibld.c	9
opcodes/microblaze-dis.c	9
opcodes/msp430-dis.c	11
opcodes/nds32-dis.c	16
libiberty/./hashtab.c	12
opcodes/nfp-dis.c	51
opcodes/./../include/dis-asm.h	1
opcodes/ns32k-dis.c	13
opcodes/mcore-dis.c	1
opcodes/mep-dis.c	17
opcodes/mep-desc.c	8
opcodes/mep-opc.c	8
opcodes/mep-asm.c	1
opcodes/mep-ibld.c	9
opcodes/metag-dis.c	1
opcodes/mips-dis.c	29
bfd/elfxx-mips.c	1
opcodes/./../include/opcode/mips.h	8
opcodes/mips16-opc.c	1
opcodes/micromips-opc.c	1
opcodes/mips-opc.c	1
opcodes/mmix-dis.c	5
opcodes/m10200-dis.c	2
opcodes/m10300-dis.c	2
opcodes/nios2-dis.c	10
opcodes/or1k-dis.c	10
opcodes/or1k-desc.c	8
opcodes/or1k-opc.c	7
opcodes/or1k-asm.c	1
opcodes/or1k-ibld.c	9
opcodes/pdp11-dis.c	7
opcodes/pj-dis.c	2
opcodes/ppc-dis.c	8
opcodes/pru-dis.c	5
opcodes/riscv-dis.c	3
bfd/cpu-riscv.c	2
bfd/elfxx-riscv.c	16
opcodes/rl78-dis.c	8
opcodes/rl78-decode.opc	3
opcodes/rx-dis.c	12
opcodes/rx-decode.opc	3
opcodes/s390-dis.c	7
opcodes/score-dis.c	7
opcodes/score7-dis.c	4
opcodes/./sh-dis.c	5
bfd/cpu-sh.c	1
opcodes/sparc-dis.c	5
opcodes/sparc-opc.c	5
opcodes/spu-dis.c	3
opcodes/tic30-dis.c	9
opcodes/tic4x-dis.c	15
opcodes/tic54x-dis.c	12
opcodes/tic6x-dis.c	7
opcodes/ft32-dis.c	4
opcodes/./../include/opcode/ft32.h	1
opcodes/v850-dis.c	11
opcodes/wasm32-dis.c	7
opcodes/xgate-dis.c	6
opcodes/xstormy16-dis.c	8
opcodes/xstormy16-desc.c	8
opcodes/xstormy16-opc.c	6
opcodes/xstormy16-asm.c	1
opcodes/xstormy16-ibld.c	9
opcodes/xtensa-dis.c	6
bfd/xtensa-isa.c	29
bfd/xtensa-dynconfig.c	1
bfd/elf32-xtensa.c	19
bfd/compress.c	3
bfd/bfdio.c	5
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/elflink.c	3
bfd/elf.c	2
opcodes/z80-dis.c	4
opcodes/z8k-dis.c	10
opcodes/vax-dis.c	7
opcodes/visium-dis.c	6
opcodes/frv-dis.c	13
opcodes/frv-desc.c	8
opcodes/frv-opc.c	6
opcodes/frv-asm.c	1
opcodes/frv-ibld.c	9
opcodes/moxie-dis.c	1
opcodes/iq2000-dis.c	9
opcodes/iq2000-desc.c	8
opcodes/iq2000-opc.c	6
opcodes/iq2000-asm.c	2
opcodes/iq2000-ibld.c	9
opcodes/m32c-dis.c	23
opcodes/m32c-desc.c	8
opcodes/m32c-opc.c	7
opcodes/m32c-asm.c	2
opcodes/m32c-ibld.c	12
opcodes/tilegx-dis.c	1
opcodes/tilegx-opc.c	4
opcodes/tilepro-dis.c	2
opcodes/tilepro-opc.c	4
opcodes/loongarch-dis.c	7
opcodes/loongarch-coder.c	6
opcodes/loongarch-opc.c	1

Fuzzer: fuzz_dwarf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1153	88.2%
gold	[1:9]	11	0.84%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	142	10.8%
All colors	1306	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2485	5388	8 : View List ['gettext', 'load_debug_section', 'display_data', 'free_dwo_info', 'process_debug_info', 'error', 'warn', 'load_dwo_file']	2485	6633	load_separate_debug_files	call site: 00172	/src/binutils-gdb/binutils/./dwarf.c:12046
988	988	1 : View List ['bfd_init_section_compress_status']	990	1016	_bfd_elf_make_section_from_shdr	call site: 00000	/src/binutils-gdb/bfd/elf.c:1220
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
266	1675	26 : View List ['alpha_vms_add_fixup_lp', 'bfd_getl64', 'alpha_vms_add_fixup_lr', '_bfd_vms_push', 'bfd_getl16', '_bfd_vms_get_value', 'image_write_w', 'image_write_q', 'image_write_l', 'dst_define_location', 'alpha_vms_add_lw_reloc', 'image_write', 'image_set_ptr', 'image_inc_ptr', 'alpha_vms_add_fixup_ca', 'dst_restore_location', 'dst_retrieve_location', 'alpha_vms_fix_sec_rel', '_bfd_abort', 'alpha_vms_add_fixup_qr', '_bfd_vms_pop', 'alpha_vms_get_sym_value', 'alpha_vms_add_qw_reloc', 'bfd_getl32', 'image_write_b', 'alpha_vms_sym_to_ctxt']	292	2251	_bfd_vms_slurp_etir	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1987
71	73	3 : View List ['dgettext', '_bfd_error_handler', 'bfd_link_hash_lookup']	71	73	_bfd_vms_get_value	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1786
66	66	1 : View List ['bfd_close']	66	190	bfd_mach_o_close_and_cleanup	call site: 00000	/src/binutils-gdb/bfd/mach-o.c:6204
61	206	6 : View List ['bfd_get_error', 'bfd_make_section_with_flags', 'bfd_read', 'ppcboot_mkobject', 'bfd_stat', 'ppcboot_set_arch_mach']	61	272	ppcboot_object_p	call site: 00000	/src/binutils-gdb/bfd/ppcboot.c:145
44	44	1 : View List ['s3_elf32_score_new_section_hook']	44	44	elf32_score_new_section_hook	call site: 00000	/src/binutils-gdb/bfd/elf32-score.c:4392
32	52	8 : View List ['stat', 'close', 'lseek', 'open', 'getenv', 'read', 'startswith.96723', 'bfd_release']	32	112	go32exe_create_stub	call site: 00000	/src/binutils-gdb/bfd/coff-stgo32.c:121
29	29	1 : View List ['close_one']	40	147	bfd_open_file	call site: 00112	/src/binutils-gdb/bfd/cache.c:597
29	29	1 : View List ['close_one']	29	31	bfd_cache_init	call site: 00073	/src/binutils-gdb/bfd/cache.c:499

Runtime coverage analysis

Covered functions

738

Functions that are reachable but not covered

182

Reachable functions

267

Percentage of reachable functions covered

31.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_dwarf.c	1
bfd/opncls.c	8
bfd/libbfd.c	4
bfd/bfd.c	11
libiberty/./objalloc.c	4
bfd/hash.c	9
bfd/section.c	6
bfd/./targets.c	3
bfd/./bfd.h	9
bfd/bfdio.c	7
bfd/cache.c	8
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
binutils/../bfd/bfd.h	3
binutils/./dwarf.c	56
binutils/./fuzz_objdump.h	7
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
bfd/simple.c	13
bfd/compress.c	3
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/linker.c	4
binutils/elfcomm.c	3
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libiberty/./xstrdup.c	1

Fuzzer: fuzz_readelf_elf32_csky

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6655	99.6%
gold	[1:9]	23	0.34%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	0.04%
All colors	6681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
107	118	7 : View List ['_bfd_real_fopen', 'fdopen', 'bfd_set_cacheable', 'bfd_set_filename', 'bfd_cache_init', 'fclose', 'bfd_set_error']	109	156	bfd_fopen	call site: 00038	/src/binutils-gdb/bfd/opncls.c:274
99	99	2 : View List ['bfd_seek', 'bfd_close']	99	99	check_architecture	call site: 00004	/src/binutils-gdb/binutils/fuzz_readelf.c:29
9	9	1 : View List ['_bfd_abort']	9	9	bfd_set_error	call site: 00009	/src/binutils-gdb/bfd/bfd.c:802
2	2	1 : View List ['getenv']	4	26	bfd_find_target	call site: 00038	/src/binutils-gdb/bfd/./targets.c:1620
2	2	1 : View List ['close']	2	14	bfd_fopen	call site: 00038	/src/binutils-gdb/bfd/opncls.c:276
0	16	2 : View List ['bfd_hash_table_free', 'bfd_set_error']	0	16	bfd_hash_table_init_n	call site: 00025	/src/binutils-gdb/bfd/hash.c:449
0	11	1 : View List ['bfd_set_error']	0	11	bfd_malloc	call site: 00009	/src/binutils-gdb/bfd/libbfd.c:291
0	11	1 : View List ['bfd_set_error']	0	11	_bfd_new_bfd	call site: 00019	/src/binutils-gdb/bfd/opncls.c:93
0	0	None	2	2	bfd_fopen	call site: 00006	/src/binutils-gdb/bfd/opncls.c:266
0	0	None	0	57	_bfd_new_bfd	call site: 00007	/src/binutils-gdb/bfd/opncls.c:84
0	0	None	0	11	bfd_hash_table_init_n	call site: 00021	/src/binutils-gdb/bfd/hash.c:435
0	0	None	0	11	bfd_hash_table_init_n	call site: 00023	/src/binutils-gdb/bfd/hash.c:442

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

990

Reachable functions

1005

Percentage of reachable functions covered

1.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_readelf.c	2
bfd/opncls.c	8
bfd/libbfd.c	3
bfd/bfd.c	4
libiberty/./objalloc.c	3
bfd/hash.c	4
bfd/section.c	1
bfd/./targets.c	2
bfd/./bfd.h	3
bfd/bfdio.c	4
bfd/cache.c	6
binutils/./dwarf.c	76
binutils/elfcomm.c	15
binutils/./readelf.h	257
binutils/../bfd/bfd.h	1
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./lbasename.c	2
binutils/./../include/elf/aarch64.h	1
binutils/./../include/elf/m32r.h	1
binutils/./../include/elf/i386.h	1
binutils/./../include/elf/m68hc11.h	1
binutils/./../include/elf/s12z.h	1
binutils/./../include/elf/m68k.h	1
binutils/./../include/elf/i960.h	1
binutils/./../include/elf/avr.h	1
binutils/./../include/elf/sparc.h	1
binutils/./../include/elf/spu.h	1
binutils/./../include/elf/v850.h	2
binutils/./../include/elf/d10v.h	1
binutils/./../include/elf/d30v.h	1
binutils/./../include/elf/dlx.h	1
binutils/./../include/elf/sh.h	1
binutils/./../include/elf/mn10300.h	1
binutils/./../include/elf/mn10200.h	1
binutils/./../include/elf/fr30.h	1
binutils/./../include/elf/frv.h	1
binutils/./../include/elf/csky.h	1
binutils/./../include/elf/ft32.h	1
binutils/./../include/elf/mcore.h	1
binutils/./../include/elf/mmix.h	1
binutils/./../include/elf/moxie.h	1
binutils/./../include/elf/msp430.h	2
binutils/./../include/elf/nds32.h	1
binutils/./../include/elf/ppc.h	1
binutils/./../include/elf/ppc64.h	2
binutils/./../include/elf/mips.h	1
binutils/./../include/elf/riscv.h	1
binutils/./../include/elf/alpha.h	1
binutils/./../include/elf/arm.h	1
binutils/./../include/elf/arc.h	1
binutils/./../include/elf/hppa.h	1
binutils/./../include/elf/h8.h	1
binutils/./../include/elf/or1k.h	1
binutils/./../include/elf/pj.h	1
binutils/./../include/elf/ia64.h	1
binutils/./../include/elf/kvx.h	1
binutils/./../include/elf/cris.h	1
binutils/./../include/elf/i860.h	1
binutils/./../include/elf/x86-64.h	1
binutils/./../include/elf/i370.h	1
binutils/./../include/elf/s390.h	1
binutils/./../include/elf/score.h	1
binutils/./../include/elf/xstormy16.h	1
binutils/./../include/elf/crx.h	1
binutils/./../include/elf/vax.h	1
binutils/./../include/elf/visium.h	1
binutils/./../include/elf/bpf.h	1
binutils/./../include/elf/epiphany.h	1
binutils/./../include/elf/ip2k.h	1
binutils/./../include/elf/iq2000.h	1
binutils/./../include/elf/xtensa.h	1
binutils/./../include/elf/lm32.h	1
binutils/./../include/elf/m32c.h	1
binutils/./../include/elf/mt.h	1
binutils/./../include/elf/bfin.h	1
binutils/./../include/elf/mep.h	1
binutils/./../include/elf/cr16.h	1
binutils/./../include/elf/microblaze.h	1
binutils/./../include/elf/rl78.h	1
binutils/./../include/elf/rx.h	1
binutils/./../include/elf/metag.h	1
binutils/./../include/elf/tic6x.h	1
binutils/./../include/elf/tilegx.h	1
binutils/./../include/elf/tilepro.h	1
binutils/./../include/elf/wasm32.h	1
binutils/./../include/elf/xgate.h	1
binutils/./../include/elf/nios2.h	1
binutils/./../include/elf/pru.h	1
binutils/./../include/elf/nfp.h	2
binutils/./../include/elf/z80.h	1
binutils/./../include/elf/loongarch.h	1
binutils/./../include/elf/amdgpu.h	1
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libctf/ctf-archive.c	15
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
libctf/ctf-open.c	30
libctf/ctf-subr.c	7
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	15
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-error.c	1
libsframe/sframe-dump.c	5

Fuzzer: fuzz_bfd_ext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	95	53.3%
gold	[1:9]	1	0.56%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	15	8.42%
lawngreen	50+	67	37.6%
All colors	178	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
29	29	1 : View List ['close_one']	31	147	bfd_open_file	call site: 00158	/src/binutils-gdb/bfd/cache.c:597
29	29	1 : View List ['close_one']	29	31	bfd_cache_init	call site: 00118	/src/binutils-gdb/bfd/cache.c:499
9	9	1 : View List ['_bfd_abort']	9	9	bfd_set_error	call site: 00062	/src/binutils-gdb/bfd/bfd.c:802
2	24	2 : View List ['__errno_location', 'bfd_set_error']	2	24	bfd_seek	call site: 00146	/src/binutils-gdb/bfd/bfdio.c:485
2	13	2 : View List ['close', 'bfd_set_error']	2	25	bfd_fopen	call site: 00097	/src/binutils-gdb/bfd/opncls.c:288
2	2	1 : View List ['fdopen']	8	144	bfd_fopen	call site: 00092	/src/binutils-gdb/bfd/opncls.c:283
2	2	1 : View List ['getenv']	4	26	bfd_find_target	call site: 00084	/src/binutils-gdb/bfd/./targets.c:1620
2	2	1 : View List ['__errno_location']	4	4	bufferToFile	call site: 00053	/src/binutils-gdb/fuzz/fuzz_bfd_ext.c:35
2	2	1 : View List ['sysconf']	2	2	bfd_cache_max_open	call site: 00119	/src/binutils-gdb/bfd/cache.c:98
0	33	2 : View List ['_objalloc_alloc', 'bfd_set_error']	0	63	bfd_hash_lookup	call site: 00000	/src/binutils-gdb/bfd/hash.c:571
0	33	1 : View List ['bfd_seek']	0	33	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:283
0	23	2 : View List ['_bfd_delete_bfd', 'bfd_set_error']	0	23	bfd_openw	call site: 00157	/src/binutils-gdb/bfd/opncls.c:785

Runtime coverage analysis

Covered functions

85

Functions that are reachable but not covered

39

Reachable functions

82

Percentage of reachable functions covered

52.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_bfd_ext.c	2
bfd/bfd.c	10
bfd/./bfd.h	4
bfd/opncls.c	9
bfd/libbfd.c	3
libiberty/./objalloc.c	3
bfd/hash.c	4
bfd/section.c	1
bfd/./targets.c	2
bfd/bfdio.c	4
bfd/cache.c	7
libiberty/./unlink-if-ordinary.c	1

Fuzzer: fuzz_disas_ext-bfd_arch_mep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6920	98.5%
gold	[1:9]	48	0.68%
yellow	[10:29]	1	0.01%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	0.79%
All colors	7025	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
200	203	4 : View List ['mep_examine_vliw64_insns', 'cgen_bitset_union', 'cgen_bitset_clear', 'mep_examine_vliw32_insns']	329	332	mep_print_insn	call site: 03469	/src/binutils-gdb/opcodes/mep-dis.c:673
129	129	1 : View List ['mep_examine_ivc2_insns']	129	129	mep_print_insn	call site: 03497	/src/binutils-gdb/opcodes/mep-dis.c:710
11	11	3 : View List ['free', 'xregerror', 'xregfree']	11	11	mep_cgen_build_insn_regex	call site: 03049	/src/binutils-gdb/opcodes/mep-asm.c:1419
9	9	1 : View List ['_bfd_abort']	9	9	bfd_put_bits	call site: 01254	/src/binutils-gdb/bfd/libbfd.c:998
9	9	1 : View List ['_bfd_abort']	9	9	bfd_get_bits	call site: 01244	/src/binutils-gdb/bfd/libbfd.c:1019
6	6	3 : View List ['abort', 'dgettext', '_bfd_error_handler']	6	6	mep_cgen_cpu_open	call site: 03023	/src/binutils-gdb/opcodes/mep-desc.c:6329
4	4	3 : View List ['bfd_get_flavour.14250', 'dgettext', '_bfd_error_handler']	462	465	mep_print_insn	call site: 03467	/src/binutils-gdb/opcodes/mep-dis.c:644
4	4	3 : View List ['malloc', '__ctype_tolower_loc', '__ctype_b_loc']	6	586	xregcomp	call site: 01072	/src/binutils-gdb/libiberty/./regex.c:7936
2	2	1 : View List ['realloc']	2	2	byte_regex_compile	call site: 01152	/src/binutils-gdb/libiberty/./regex.c:4160
2	2	1 : View List ['memcmp']	2	2	cgen_bitset_compare	call site: 01029	/src/binutils-gdb/opcodes/cgen-bitset.c:113
2	2	1 : View List ['abort']	2	2	cgen_get_insn_value	call site: 01242	/src/binutils-gdb/opcodes/cgen-opc.c:373
0	0	None	203	251	byte_regex_compile	call site: 01076	/src/binutils-gdb/libiberty/./regex.c:2424

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

1018

Reachable functions

1067

Percentage of reachable functions covered

4.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_disas_ext.c	4
opcodes/dis-init.c	1
bfd/libbfd.c	12
bfd/./archures.c	4
opcodes/./disassemble.c	5
opcodes/alpha-dis.c	1
opcodes/arc-dis.c	1
opcodes/arc-ext.c	3
opcodes/../bfd/bfd.h	8
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
bfd/section.c	5
bfd/./bfd.h	7
bfd/bfd.c	5
libiberty/./xstrdup.c	1
opcodes/avr-dis.c	3
opcodes/bfin-dis.c	51
opcodes/cr16-dis.c	22
opcodes/cris-dis.c	20
opcodes/crx-dis.c	19
opcodes/csky-dis.c	1
bfd/hash.c	4
libiberty/./objalloc.c	2
opcodes/d10v-dis.c	4
opcodes/d10v-opc.c	1
opcodes/d30v-dis.c	4
opcodes/d30v-opc.c	1
opcodes/dlx-dis.c	8
opcodes/h8300-dis.c	7
opcodes/hppa-dis.c	20
opcodes/../bfd/libhppa.h	2
opcodes/i386-dis.c	32
opcodes/ia64-dis.c	2
opcodes/ia64-opc.c	8
opcodes/ip2k-dis.c	15
opcodes/cgen-bitset.c	10
opcodes/ip2k-desc.c	8
opcodes/ip2k-opc.c	8
opcodes/ip2k-asm.c	1
libiberty/./regex.c	15
opcodes/ip2k-ibld.c	9
opcodes/cgen-opc.c	9
opcodes/cgen-dis.c	6
opcodes/bpf-dis.c	4
opcodes/bpf-opc.c	7
opcodes/epiphany-dis.c	12
opcodes/epiphany-desc.c	8
opcodes/epiphany-opc.c	6
opcodes/epiphany-asm.c	1
opcodes/epiphany-ibld.c	9
opcodes/fr30-dis.c	15
opcodes/fr30-desc.c	8
opcodes/fr30-opc.c	6
opcodes/fr30-asm.c	1
opcodes/fr30-ibld.c	12
opcodes/kvx-dis.c	11
opcodes/lm32-dis.c	9
opcodes/lm32-desc.c	8
opcodes/lm32-opc.c	6
opcodes/lm32-asm.c	1
opcodes/lm32-ibld.c	9
opcodes/m32r-dis.c	12
opcodes/m32r-desc.c	8
opcodes/m32r-opc.c	7
opcodes/m32r-asm.c	1
opcodes/m32r-ibld.c	9
opcodes/m68hc11-dis.c	7
opcodes/s12z-dis.c	7
opcodes/s12z-opc.c	2
opcodes/m68k-dis.c	12
bfd/cpu-m68k.c	1
libiberty/./floatformat.c	3
opcodes/mt-dis.c	10
opcodes/mt-desc.c	8
opcodes/mt-opc.c	8
opcodes/mt-asm.c	1
opcodes/mt-ibld.c	9
opcodes/microblaze-dis.c	9
opcodes/msp430-dis.c	11
opcodes/nds32-dis.c	16
libiberty/./hashtab.c	12
opcodes/nfp-dis.c	51
opcodes/./../include/dis-asm.h	1
opcodes/ns32k-dis.c	13
opcodes/mcore-dis.c	1
opcodes/mep-dis.c	17
opcodes/mep-desc.c	8
opcodes/mep-opc.c	8
opcodes/mep-asm.c	1
opcodes/mep-ibld.c	9
opcodes/metag-dis.c	1
opcodes/mips-dis.c	29
bfd/elfxx-mips.c	1
opcodes/./../include/opcode/mips.h	8
opcodes/mips16-opc.c	1
opcodes/micromips-opc.c	1
opcodes/mips-opc.c	1
opcodes/mmix-dis.c	5
opcodes/m10200-dis.c	2
opcodes/m10300-dis.c	2
opcodes/nios2-dis.c	10
opcodes/or1k-dis.c	10
opcodes/or1k-desc.c	8
opcodes/or1k-opc.c	7
opcodes/or1k-asm.c	1
opcodes/or1k-ibld.c	9
opcodes/pdp11-dis.c	7
opcodes/pj-dis.c	2
opcodes/ppc-dis.c	8
opcodes/pru-dis.c	5
opcodes/riscv-dis.c	3
bfd/cpu-riscv.c	2
bfd/elfxx-riscv.c	16
opcodes/rl78-dis.c	8
opcodes/rl78-decode.opc	3
opcodes/rx-dis.c	12
opcodes/rx-decode.opc	3
opcodes/s390-dis.c	7
opcodes/score-dis.c	7
opcodes/score7-dis.c	4
opcodes/./sh-dis.c	5
bfd/cpu-sh.c	1
opcodes/sparc-dis.c	5
opcodes/sparc-opc.c	5
opcodes/spu-dis.c	3
opcodes/tic30-dis.c	9
opcodes/tic4x-dis.c	15
opcodes/tic54x-dis.c	12
opcodes/tic6x-dis.c	7
opcodes/ft32-dis.c	4
opcodes/./../include/opcode/ft32.h	1
opcodes/v850-dis.c	11
opcodes/wasm32-dis.c	7
opcodes/xgate-dis.c	6
opcodes/xstormy16-dis.c	8
opcodes/xstormy16-desc.c	8
opcodes/xstormy16-opc.c	6
opcodes/xstormy16-asm.c	1
opcodes/xstormy16-ibld.c	9
opcodes/xtensa-dis.c	6
bfd/xtensa-isa.c	29
bfd/xtensa-dynconfig.c	1
bfd/elf32-xtensa.c	19
bfd/compress.c	3
bfd/bfdio.c	5
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/elflink.c	3
bfd/elf.c	2
opcodes/z80-dis.c	4
opcodes/z8k-dis.c	10
opcodes/vax-dis.c	7
opcodes/visium-dis.c	6
opcodes/frv-dis.c	13
opcodes/frv-desc.c	8
opcodes/frv-opc.c	6
opcodes/frv-asm.c	1
opcodes/frv-ibld.c	9
opcodes/moxie-dis.c	1
opcodes/iq2000-dis.c	9
opcodes/iq2000-desc.c	8
opcodes/iq2000-opc.c	6
opcodes/iq2000-asm.c	2
opcodes/iq2000-ibld.c	9
opcodes/m32c-dis.c	23
opcodes/m32c-desc.c	8
opcodes/m32c-opc.c	7
opcodes/m32c-asm.c	2
opcodes/m32c-ibld.c	12
opcodes/tilegx-dis.c	1
opcodes/tilegx-opc.c	4
opcodes/tilepro-dis.c	2
opcodes/tilepro-opc.c	4
opcodes/loongarch-dis.c	7
opcodes/loongarch-coder.c	6
opcodes/loongarch-opc.c	1

Fuzzer: fuzz_dlltool

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	231	52.1%
gold	[1:9]	11	2.48%
yellow	[10:29]	2	0.45%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	199	44.9%
All colors	443	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
988	988	1 : View List ['bfd_init_section_compress_status']	990	1016	_bfd_elf_make_section_from_shdr	call site: 00000	/src/binutils-gdb/bfd/elf.c:1220
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
636	869	16 : View List ['def_code', 'def_exports', 'def_import', 'def_data', 'def_version', 'malloc', 'xmalloc', 'yylex', 'def_section', 'def_description', 'def_library', 'yyerror', 'def_heapsize', 'strlen', 'def_name', 'def_stacksize']	636	877	yyparse	call site: 00162	/src/binutils-gdb/binutils/defparse.c:2111
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
316	398	6 : View List ['bfd_get_error', 'bfd_read', 'som_object_setup', 'som_swap_exec_auxhdr_in', 'bfd_zalloc', 'setup_sections']	316	420	som_object_p	call site: 00000	/src/binutils-gdb/bfd/som.c:2489
266	1675	26 : View List ['alpha_vms_add_fixup_lp', 'bfd_getl64', 'alpha_vms_add_fixup_lr', '_bfd_vms_push', 'bfd_getl16', '_bfd_vms_get_value', 'image_write_w', 'image_write_q', 'image_write_l', 'dst_define_location', 'alpha_vms_add_lw_reloc', 'image_write', 'image_set_ptr', 'image_inc_ptr', 'alpha_vms_add_fixup_ca', 'dst_restore_location', 'dst_retrieve_location', 'alpha_vms_fix_sec_rel', '_bfd_abort', 'alpha_vms_add_fixup_qr', '_bfd_vms_pop', 'alpha_vms_get_sym_value', 'alpha_vms_add_qw_reloc', 'bfd_getl32', 'image_write_b', 'alpha_vms_sym_to_ctxt']	292	2251	_bfd_vms_slurp_etir	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1987
221	223	10 : View List ['strcmp', 'bfd_elf_add_obj_attr_int', 'elf_add_obj_attr_int_string', '_bfd_abort', 'dgettext', '_bfd_error_handler', '_bfd_elf_obj_attrs_arg_type', '_bfd_safe_read_leb128', 'strnlen', 'elf_add_obj_attr_string']	221	223	_bfd_elf_parse_attributes	call site: 00000	/src/binutils-gdb/bfd/elf-attrs.c:496
169	929	10 : View List ['bfd_write', 'bfd_malloc', 'bfd_read', 'bfd_zmalloc', 'bfd_seek', 'bfd_create', 'bfd_close', 'free', 'bfd_getl32', 'bfd_make_writable']	169	1028	pdb_get_elt_at_index	call site: 00000	/src/binutils-gdb/bfd/pdb.c:124
108	182	5 : View List ['_bfd_alloc_and_read.98294', 'ecoff_slurp_symbolic_header', 'bfd_alloc', 'bfd_seek', 'bfd_set_error']	108	182	_bfd_ecoff_slurp_symbolic_info	call site: 00000	/src/binutils-gdb/bfd/ecoff.c:532
71	73	3 : View List ['dgettext', '_bfd_error_handler', 'bfd_link_hash_lookup']	71	73	_bfd_vms_get_value	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1786
61	138	3 : View List ['bfd_make_section_with_flags', 'ppcboot_mkobject', 'ppcboot_set_arch_mach']	61	149	ppcboot_object_p	call site: 00000	/src/binutils-gdb/bfd/ppcboot.c:180
41	142	7 : View List ['bfd_get_error', 'bfd_set_error', 'dgettext', '_bfd_real_fseek', '_bfd_error_handler', 'bfd_errmsg', 'bfd_open_file']	41	142	bfd_cache_lookup_worker	call site: 00000	/src/binutils-gdb/bfd/cache.c:247

Runtime coverage analysis

Covered functions

816

Functions that are reachable but not covered

80

Reachable functions

191

Percentage of reachable functions covered

58.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_dlltool.c	3
binutils/./fuzz_dlltool.h	23
binutils/bucomm.c	5
libiberty/./xexit.c	1
binutils/defparse.c	2
binutils/deflex.c	13
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	2
libiberty/./xmemdup.c	1
libiberty/./lbasename.c	2
libiberty/./concat.c	3
bfd/opncls.c	8
bfd/libbfd.c	4
bfd/bfd.c	10
libiberty/./objalloc.c	4
bfd/hash.c	9
bfd/section.c	4
bfd/./targets.c	3
bfd/./bfd.h	6
bfd/bfdio.c	4
bfd/cache.c	8
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
bfd/archive.c	1
binutils/../bfd/bfd.h	8
libiberty/./xstrerror.c	1

Fuzzer: fuzz_readelf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3886	58.9%
gold	[1:9]	301	4.56%
yellow	[10:29]	312	4.73%
greenyellow	[30:49]	169	2.56%
lawngreen	50+	1921	29.1%
All colors	6589	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2473	5388	8 : View List ['gettext', 'load_debug_section', 'display_data', 'free_dwo_info', 'process_debug_info', 'error', 'warn', 'load_dwo_file']	2473	6633	load_separate_debug_files	call site: 03380	/src/binutils-gdb/binutils/./dwarf.c:12046
1746	1746	1 : View List ['cplus_demangle']	1760	1760	print_symbol	call site: 01668	/src/binutils-gdb/binutils/./readelf.h:668
168	189	3 : View List ['is_ia64_vms', 'offset_from_vma', 'process_ia64_vms_dynamic_relocs']	176	6188	process_relocs	call site: 01508	/src/binutils-gdb/binutils/./readelf.h:8783
128	128	1 : View List ['guess_is_rela']	170	9952	dump_relocations	call site: 01514	/src/binutils-gdb/binutils/./readelf.h:1490
16	39403	12 : View List ['memcmp', 'process_object', 'adjust_relative_path', 'fseek64', 'rewind', 'make_qualified_name', 'strtoul', 'fread', 'close_file', 'strlen', 'open_file', 'get_archive_member_name']	34	39457	process_archive	call site: 00201	/src/binutils-gdb/binutils/./readelf.h:23332
14	26	2 : View List ['gettext', 'warn']	14	26	get_elf_section_flags	call site: 01006	/src/binutils-gdb/binutils/./readelf.h:7433
8	245	6 : View List ['ftell', 'putchar', 'ngettext', 'print_vma', 'strnlen', 'get_archive_member_name_at']	52	39755	process_archive	call site: 00033	/src/binutils-gdb/binutils/./readelf.h:23164
7	7	2 : View List ['gettext', 'xexit']	7	7	xcmalloc	call site: 03166	/src/binutils-gdb/binutils/./dwarf.c:11243
6	6	2 : View List ['__errno_location', 'strerror']	10	18	process_file	call site: 00011	/src/binutils-gdb/binutils/./readelf.h:23426
4	8	3 : View List ['gettext', 'error', 'abort']	4	8	byte_put_little_endian	call site: 00211	/src/binutils-gdb/binutils/elfcomm.c:71
4	4	1 : View List ['free_debug_information']	39	42	free_debug_memory	call site: 06563	/src/binutils-gdb/binutils/./dwarf.c:12173
2	251	2 : View List ['memcmp', 'get_archive_member_name']	4	257	get_archive_member_name_at	call site: 00103	/src/binutils-gdb/binutils/elfcomm.c:736

Runtime coverage analysis

Covered functions

404

Functions that are reachable but not covered

608

Reachable functions

960

Percentage of reachable functions covered

36.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_readelf.c	1
binutils/./dwarf.c	76
binutils/elfcomm.c	15
binutils/./readelf.h	257
binutils/../bfd/bfd.h	1
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./lbasename.c	2
binutils/./../include/elf/aarch64.h	1
binutils/./../include/elf/m32r.h	1
binutils/./../include/elf/i386.h	1
binutils/./../include/elf/m68hc11.h	1
binutils/./../include/elf/s12z.h	1
binutils/./../include/elf/m68k.h	1
binutils/./../include/elf/i960.h	1
binutils/./../include/elf/avr.h	1
binutils/./../include/elf/sparc.h	1
binutils/./../include/elf/spu.h	1
binutils/./../include/elf/v850.h	2
binutils/./../include/elf/d10v.h	1
binutils/./../include/elf/d30v.h	1
binutils/./../include/elf/dlx.h	1
binutils/./../include/elf/sh.h	1
binutils/./../include/elf/mn10300.h	1
binutils/./../include/elf/mn10200.h	1
binutils/./../include/elf/fr30.h	1
binutils/./../include/elf/frv.h	1
binutils/./../include/elf/csky.h	1
binutils/./../include/elf/ft32.h	1
binutils/./../include/elf/mcore.h	1
binutils/./../include/elf/mmix.h	1
binutils/./../include/elf/moxie.h	1
binutils/./../include/elf/msp430.h	2
binutils/./../include/elf/nds32.h	1
binutils/./../include/elf/ppc.h	1
binutils/./../include/elf/ppc64.h	2
binutils/./../include/elf/mips.h	1
binutils/./../include/elf/riscv.h	1
binutils/./../include/elf/alpha.h	1
binutils/./../include/elf/arm.h	1
binutils/./../include/elf/arc.h	1
binutils/./../include/elf/hppa.h	1
binutils/./../include/elf/h8.h	1
binutils/./../include/elf/or1k.h	1
binutils/./../include/elf/pj.h	1
binutils/./../include/elf/ia64.h	1
binutils/./../include/elf/kvx.h	1
binutils/./../include/elf/cris.h	1
binutils/./../include/elf/i860.h	1
binutils/./../include/elf/x86-64.h	1
binutils/./../include/elf/i370.h	1
binutils/./../include/elf/s390.h	1
binutils/./../include/elf/score.h	1
binutils/./../include/elf/xstormy16.h	1
binutils/./../include/elf/crx.h	1
binutils/./../include/elf/vax.h	1
binutils/./../include/elf/visium.h	1
binutils/./../include/elf/bpf.h	1
binutils/./../include/elf/epiphany.h	1
binutils/./../include/elf/ip2k.h	1
binutils/./../include/elf/iq2000.h	1
binutils/./../include/elf/xtensa.h	1
binutils/./../include/elf/lm32.h	1
binutils/./../include/elf/m32c.h	1
binutils/./../include/elf/mt.h	1
binutils/./../include/elf/bfin.h	1
binutils/./../include/elf/mep.h	1
binutils/./../include/elf/cr16.h	1
binutils/./../include/elf/microblaze.h	1
binutils/./../include/elf/rl78.h	1
binutils/./../include/elf/rx.h	1
binutils/./../include/elf/metag.h	1
binutils/./../include/elf/tic6x.h	1
binutils/./../include/elf/tilegx.h	1
binutils/./../include/elf/tilepro.h	1
binutils/./../include/elf/wasm32.h	1
binutils/./../include/elf/xgate.h	1
binutils/./../include/elf/nios2.h	1
binutils/./../include/elf/pru.h	1
binutils/./../include/elf/nfp.h	2
binutils/./../include/elf/z80.h	1
binutils/./../include/elf/loongarch.h	1
binutils/./../include/elf/amdgpu.h	1
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libctf/ctf-archive.c	15
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
libctf/ctf-open.c	30
libctf/ctf-subr.c	7
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	15
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-error.c	1
libsframe/sframe-dump.c	5

Fuzzer: fuzz_readelf_elf64_mmix

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6635	99.3%
gold	[1:9]	44	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	0.02%
All colors	6681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2330	2740	19 : View List ['elf_swap_ehdr_in', 'bfd_set_start_address', 'bfd_default_set_arch_mach', 'bfd_elf64_swap_phdr_in', '_bfd_elf_get_dynamic_symbols', 'elf_file_p', '_bfd_elf_setup_sections', 'bfd_get_file_size', 'bfd_read', 'dgettext', 'bfd_header_big_endian', '_bfd_error_handler', 'bfd_section_from_elf_index', 'elf_swap_shdr_in', 'bfd_header_little_endian', 'bfd_alloc', 'bfd_section_from_shdr', 'bfd_seek', 'bfd_zalloc']	2330	2751	bfd_elf64_object_p	call site: 00000	/src/binutils-gdb/bfd/./elfcode.h:532
29	29	1 : View List ['close_one']	29	31	bfd_cache_init	call site: 00072	/src/binutils-gdb/bfd/cache.c:499
9	9	1 : View List ['_bfd_abort']	9	9	bfd_set_error	call site: 00009	/src/binutils-gdb/bfd/bfd.c:802
2	13	2 : View List ['close', 'bfd_set_error']	2	25	bfd_fopen	call site: 00051	/src/binutils-gdb/bfd/opncls.c:288
2	2	1 : View List ['fdopen']	8	144	bfd_fopen	call site: 00046	/src/binutils-gdb/bfd/opncls.c:283
2	2	1 : View List ['getenv']	4	26	bfd_find_target	call site: 00038	/src/binutils-gdb/bfd/./targets.c:1620
2	2	1 : View List ['sysconf']	2	2	bfd_cache_max_open	call site: 00073	/src/binutils-gdb/bfd/cache.c:98
2	2	1 : View List ['remove']	2	2	check_architecture	call site: 00004	/src/binutils-gdb/binutils/fuzz_readelf.c:29
0	33	1 : View List ['bfd_seek']	0	33	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:283
0	16	2 : View List ['bfd_hash_table_free', 'bfd_set_error']	0	16	bfd_hash_table_init_n	call site: 00025	/src/binutils-gdb/bfd/hash.c:449
0	11	1 : View List ['bfd_set_error']	0	14	bfd_cache_delete	call site: 00079	/src/binutils-gdb/bfd/cache.c:168
0	11	1 : View List ['bfd_set_error']	0	11	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:277

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

975

Reachable functions

1005

Percentage of reachable functions covered

2.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_readelf.c	2
bfd/opncls.c	8
bfd/libbfd.c	3
bfd/bfd.c	4
libiberty/./objalloc.c	3
bfd/hash.c	4
bfd/section.c	1
bfd/./targets.c	2
bfd/./bfd.h	3
bfd/bfdio.c	4
bfd/cache.c	6
binutils/./dwarf.c	76
binutils/elfcomm.c	15
binutils/./readelf.h	257
binutils/../bfd/bfd.h	1
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./lbasename.c	2
binutils/./../include/elf/aarch64.h	1
binutils/./../include/elf/m32r.h	1
binutils/./../include/elf/i386.h	1
binutils/./../include/elf/m68hc11.h	1
binutils/./../include/elf/s12z.h	1
binutils/./../include/elf/m68k.h	1
binutils/./../include/elf/i960.h	1
binutils/./../include/elf/avr.h	1
binutils/./../include/elf/sparc.h	1
binutils/./../include/elf/spu.h	1
binutils/./../include/elf/v850.h	2
binutils/./../include/elf/d10v.h	1
binutils/./../include/elf/d30v.h	1
binutils/./../include/elf/dlx.h	1
binutils/./../include/elf/sh.h	1
binutils/./../include/elf/mn10300.h	1
binutils/./../include/elf/mn10200.h	1
binutils/./../include/elf/fr30.h	1
binutils/./../include/elf/frv.h	1
binutils/./../include/elf/csky.h	1
binutils/./../include/elf/ft32.h	1
binutils/./../include/elf/mcore.h	1
binutils/./../include/elf/mmix.h	1
binutils/./../include/elf/moxie.h	1
binutils/./../include/elf/msp430.h	2
binutils/./../include/elf/nds32.h	1
binutils/./../include/elf/ppc.h	1
binutils/./../include/elf/ppc64.h	2
binutils/./../include/elf/mips.h	1
binutils/./../include/elf/riscv.h	1
binutils/./../include/elf/alpha.h	1
binutils/./../include/elf/arm.h	1
binutils/./../include/elf/arc.h	1
binutils/./../include/elf/hppa.h	1
binutils/./../include/elf/h8.h	1
binutils/./../include/elf/or1k.h	1
binutils/./../include/elf/pj.h	1
binutils/./../include/elf/ia64.h	1
binutils/./../include/elf/kvx.h	1
binutils/./../include/elf/cris.h	1
binutils/./../include/elf/i860.h	1
binutils/./../include/elf/x86-64.h	1
binutils/./../include/elf/i370.h	1
binutils/./../include/elf/s390.h	1
binutils/./../include/elf/score.h	1
binutils/./../include/elf/xstormy16.h	1
binutils/./../include/elf/crx.h	1
binutils/./../include/elf/vax.h	1
binutils/./../include/elf/visium.h	1
binutils/./../include/elf/bpf.h	1
binutils/./../include/elf/epiphany.h	1
binutils/./../include/elf/ip2k.h	1
binutils/./../include/elf/iq2000.h	1
binutils/./../include/elf/xtensa.h	1
binutils/./../include/elf/lm32.h	1
binutils/./../include/elf/m32c.h	1
binutils/./../include/elf/mt.h	1
binutils/./../include/elf/bfin.h	1
binutils/./../include/elf/mep.h	1
binutils/./../include/elf/cr16.h	1
binutils/./../include/elf/microblaze.h	1
binutils/./../include/elf/rl78.h	1
binutils/./../include/elf/rx.h	1
binutils/./../include/elf/metag.h	1
binutils/./../include/elf/tic6x.h	1
binutils/./../include/elf/tilegx.h	1
binutils/./../include/elf/tilepro.h	1
binutils/./../include/elf/wasm32.h	1
binutils/./../include/elf/xgate.h	1
binutils/./../include/elf/nios2.h	1
binutils/./../include/elf/pru.h	1
binutils/./../include/elf/nfp.h	2
binutils/./../include/elf/z80.h	1
binutils/./../include/elf/loongarch.h	1
binutils/./../include/elf/amdgpu.h	1
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libctf/ctf-archive.c	15
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
libctf/ctf-open.c	30
libctf/ctf-subr.c	7
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	15
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-error.c	1
libsframe/sframe-dump.c	5

Fuzzer: fuzz_addr2line

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1428	88.7%
gold	[1:9]	1	0.06%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	179	11.1%
All colors	1609	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3962	3962	3 : View List ['stash_maybe_enable_info_hash_tables', 'stash_find_line_fast', 'stash_maybe_update_info_hash_tables']	7834	11507	_bfd_dwarf2_find_nearest_line_with_alt	call site: 00000	/src/binutils-gdb/bfd/./dwarf2.c:5872
988	988	1 : View List ['bfd_init_section_compress_status']	990	1016	_bfd_elf_make_section_from_shdr	call site: 00000	/src/binutils-gdb/bfd/elf.c:1220
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
915	981	3 : View List ['bfd_mach_o_dsym_for_uuid_p', 'bfd_close', 'bfd_mach_o_fat_extract']	915	981	bfd_mach_o_find_dsym	call site: 00000	/src/binutils-gdb/bfd/mach-o.c:6087
739	739	1 : View List ['read_rnglists']	739	739	read_rangelist	call site: 00000	/src/binutils-gdb/bfd/./dwarf2.c:3788
671	671	2 : View List ['get_opd_info', 'opd_entry_value']	671	671	ppc64_elf_maybe_function_sym	call site: 00000	/src/binutils-gdb/bfd/elf64-ppc.c:5730
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
268	1675	26 : View List ['alpha_vms_add_fixup_lp', 'bfd_getl64', 'alpha_vms_add_fixup_lr', '_bfd_vms_push', 'bfd_getl16', '_bfd_vms_get_value', 'image_write_w', 'image_write_q', 'image_write_l', 'dst_define_location', 'alpha_vms_add_lw_reloc', 'image_write', 'image_set_ptr', 'image_inc_ptr', 'alpha_vms_add_fixup_ca', 'dst_restore_location', 'dst_retrieve_location', 'alpha_vms_fix_sec_rel', '_bfd_abort', 'alpha_vms_add_fixup_qr', '_bfd_vms_pop', 'alpha_vms_get_sym_value', 'alpha_vms_add_qw_reloc', 'bfd_getl32', 'image_write_b', 'alpha_vms_sym_to_ctxt']	294	2251	_bfd_vms_slurp_etir	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1987
222	222	4 : View List ['elf_hash_table.87753', '_bfd_generic_link_add_one_symbol', 'is_elf_hash_table.87754', 'elf_hash_table_id.87755']	222	222	ppc64_elf_set_toc	call site: 00000	/src/binutils-gdb/bfd/elf64-ppc.c:14571
172	174	4 : View List ['bfd_get_symcount.98235', 'dgettext', 'ecoff_set_symbol_info', '_bfd_error_handler']	172	207	_bfd_ecoff_slurp_symbol_table	call site: 00000	/src/binutils-gdb/bfd/ecoff.c:927
71	73	3 : View List ['dgettext', '_bfd_error_handler', 'bfd_link_hash_lookup']	71	73	_bfd_vms_get_value	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1786
71	71	2 : View List ['defined_sym_val', 'bfd_link_hash_lookup']	293	581	ppc64_elf_set_toc	call site: 00000	/src/binutils-gdb/bfd/elf64-ppc.c:14493

Runtime coverage analysis

Covered functions

1109

Functions that are reachable but not covered

253

Reachable functions

344

Percentage of reachable functions covered

26.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_addr2line.c	1
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
libiberty/./xstrdup.c	1
binutils/./fuzz_addr2line.h	7
binutils/bucomm.c	6
bfd/opncls.c	8
bfd/libbfd.c	4
bfd/bfd.c	14
libiberty/./objalloc.c	4
bfd/hash.c	9
bfd/section.c	4
bfd/./targets.c	3
bfd/./bfd.h	6
bfd/bfdio.c	4
bfd/cache.c	8
libiberty/./xstrerror.c	1
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
binutils/../bfd/bfd.h	7
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
bfd/./archures.c	1

Fuzzer: fuzz_nm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1490	87.1%
gold	[1:9]	7	0.40%
yellow	[10:29]	5	0.29%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	207	12.1%
All colors	1709	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1863	1863	1 : View List ['print_symdef_entry']	1863	2798	display_archive	call site: 00208	/src/binutils-gdb/binutils/./fuzz_nm.h:1575
1783	1783	1 : View List ['bfd_demangle']	1857	1859	print_symname	call site: 00216	/src/binutils-gdb/binutils/./fuzz_nm.h:698
988	988	1 : View List ['bfd_init_section_compress_status']	990	1016	_bfd_elf_make_section_from_shdr	call site: 00000	/src/binutils-gdb/bfd/elf.c:1220
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
915	981	3 : View List ['bfd_mach_o_dsym_for_uuid_p', 'bfd_close', 'bfd_mach_o_fat_extract']	915	981	bfd_mach_o_find_dsym	call site: 00000	/src/binutils-gdb/bfd/mach-o.c:6087
739	739	1 : View List ['read_rnglists']	739	739	read_rangelist	call site: 00000	/src/binutils-gdb/bfd/./dwarf2.c:3788
671	671	2 : View List ['get_opd_info', 'opd_entry_value']	671	671	ppc64_elf_maybe_function_sym	call site: 00000	/src/binutils-gdb/bfd/elf64-ppc.c:5730
667	667	1 : View List ['opd_entry_value']	667	667	ppc64_elf_branch_reloc	call site: 00000	/src/binutils-gdb/bfd/elf64-ppc.c:1474
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
509	1204	7 : View List ['bfd_read', 'get_hash_table_data', 'offset_from_vma', '_bfd_alloc_and_read', 'bfd_alloc', '_bfd_malloc_and_read.76278', 'bfd_set_error']	509	1600	_bfd_elf_get_dynamic_symbols	call site: 00000	/src/binutils-gdb/bfd/elf.c:2066
308	1675	26 : View List ['alpha_vms_add_fixup_lp', 'bfd_getl64', 'alpha_vms_add_fixup_lr', '_bfd_vms_push', 'bfd_getl16', '_bfd_vms_get_value', 'image_write_w', 'image_write_q', 'image_write_l', 'dst_define_location', 'alpha_vms_add_lw_reloc', 'image_write', 'image_set_ptr', 'image_inc_ptr', 'alpha_vms_add_fixup_ca', 'dst_restore_location', 'dst_retrieve_location', 'alpha_vms_fix_sec_rel', '_bfd_abort', 'alpha_vms_add_fixup_qr', '_bfd_vms_pop', 'alpha_vms_get_sym_value', 'alpha_vms_add_qw_reloc', 'bfd_getl32', 'image_write_b', 'alpha_vms_sym_to_ctxt']	334	2251	_bfd_vms_slurp_etir	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:1987
225	225	1 : View List ['_bfd_vms_lib_get_module']	225	225	_bfd_vms_lib_openr_next_archived_file	call site: 00000	/src/binutils-gdb/bfd/vms-lib.c:1554

Runtime coverage analysis

Covered functions

1249

Functions that are reachable but not covered

261

Reachable functions

370

Percentage of reachable functions covered

29.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_nm.c	1
binutils/./fuzz_nm.h	19
binutils/bucomm.c	6
bfd/opncls.c	8
bfd/libbfd.c	4
bfd/bfd.c	14
libiberty/./objalloc.c	4
bfd/hash.c	5
bfd/section.c	3
bfd/./targets.c	3
bfd/./bfd.h	6
bfd/bfdio.c	4
bfd/cache.c	8
libiberty/./xstrerror.c	1
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
binutils/../bfd/bfd.h	15
bfd/archive.c	2
libiberty/./cplus-dem.c	2
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
libiberty/./concat.c	4
bfd/./archures.c	1

Fuzzer: fuzz_strings

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	220	60.2%
gold	[1:9]	18	4.93%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	3	0.82%
lawngreen	50+	123	33.6%
All colors	365	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1875	1875	2 : View List ['_bfd_elf_setup_sections', 'bfd_section_from_shdr']	1877	1890	bfd_elf64_object_p	call site: 00000	/src/binutils-gdb/bfd/./elfcode.h:871
1875	1875	2 : View List ['_bfd_elf_setup_sections', 'bfd_section_from_shdr']	1877	1890	bfd_elf32_object_p	call site: 00000	/src/binutils-gdb/bfd/./elfcode.h:871
1060	1154	6 : View List ['_bfd_vms_slurp_etbt', '_bfd_vms_slurp_egsd', '_bfd_vms_slurp_edbg', '_bfd_vms_slurp_eeom', '_bfd_vms_get_object_record', '_bfd_vms_slurp_ehdr']	1060	1154	_bfd_vms_slurp_object_records	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:2705
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
236	269	2 : View List ['bfd_pef_scan', 'bfd_zalloc']	236	280	bfd_pef_object_p	call site: 00000	/src/binutils-gdb/bfd/pef.c:599
220	240	3 : View List ['ihex_scan', 'bfd_release', 'ihex_mkobject']	220	262	ihex_object_p	call site: 00000	/src/binutils-gdb/bfd/ihex.c:505
76	201	7 : View List ['bfd_getl64', 'bfd_set_section_flags', 'bfd_assert', '_bfd_vms_save_counted_string', 'bfd_alloc', 'bfd_getl32', 'bfd_make_section']	76	201	_bfd_vms_slurp_eisd	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:554
61	206	6 : View List ['bfd_get_error', 'bfd_make_section_with_flags', 'bfd_read', 'ppcboot_mkobject', 'bfd_stat', 'ppcboot_set_arch_mach']	61	272	ppcboot_object_p	call site: 00000	/src/binutils-gdb/bfd/ppcboot.c:145
50	632	4 : View List ['bfd_default_set_arch_mach', '_bfd_vms_slurp_object_records', 'bfd_getl16', '_bfd_vms_slurp_ehdr']	50	666	alpha_vms_object_p	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:2888
33	33	1 : View List ['bfd_pef_xlib_scan']	33	44	bfd_pef_xlib_object_p	call site: 00000	/src/binutils-gdb/bfd/pef.c:1132
30	82	3 : View List ['bfd_read', 'maybe_adjust_record_pointer_for_object', 'bfd_realloc_or_free']	30	104	vms_get_remaining_object_record	call site: 00000	/src/binutils-gdb/bfd/vms-alpha.c:847

Runtime coverage analysis

Covered functions

433

Functions that are reachable but not covered

90

Reachable functions

167

Percentage of reachable functions covered

46.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_strings.c	1
binutils/./fuzz_strings.h	12
bfd/opncls.c	8
bfd/libbfd.c	4
bfd/bfd.c	10
libiberty/./objalloc.c	4
bfd/hash.c	5
bfd/section.c	5
bfd/./targets.c	3
bfd/./bfd.h	8
bfd/bfdio.c	7
bfd/cache.c	8
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
binutils/../bfd/bfd.h	1
bfd/compress.c	3
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/bucomm.c	3
libiberty/./xmalloc.c	2
libiberty/./xexit.c	1
libiberty/./xstrerror.c	1

Fuzzer: fuzz_readelf_elf32_bigarm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6635	99.3%
gold	[1:9]	44	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	6681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2223	2633	19 : View List ['bfd_header_big_endian.78178', 'bfd_set_start_address', 'bfd_default_set_arch_mach', '_bfd_elf_get_dynamic_symbols', 'bfd_elf32_swap_phdr_in', '_bfd_elf_setup_sections', 'bfd_get_file_size', 'elf_file_p.78177', 'bfd_header_little_endian.78179', 'bfd_read', 'dgettext', '_bfd_error_handler', 'bfd_section_from_elf_index', 'elf_swap_ehdr_in.78180', 'elf_swap_shdr_in.78185', 'bfd_alloc', 'bfd_section_from_shdr', 'bfd_seek', 'bfd_zalloc']	2223	2644	bfd_elf32_object_p	call site: 00000	/src/binutils-gdb/bfd/./elfcode.h:532
29	29	1 : View List ['close_one']	29	31	bfd_cache_init	call site: 00072	/src/binutils-gdb/bfd/cache.c:499
9	9	1 : View List ['_bfd_abort']	9	9	bfd_set_error	call site: 00009	/src/binutils-gdb/bfd/bfd.c:802
2	13	2 : View List ['close', 'bfd_set_error']	2	25	bfd_fopen	call site: 00051	/src/binutils-gdb/bfd/opncls.c:288
2	2	1 : View List ['fdopen']	8	144	bfd_fopen	call site: 00046	/src/binutils-gdb/bfd/opncls.c:283
2	2	1 : View List ['getenv']	4	26	bfd_find_target	call site: 00038	/src/binutils-gdb/bfd/./targets.c:1620
2	2	1 : View List ['sysconf']	2	2	bfd_cache_max_open	call site: 00073	/src/binutils-gdb/bfd/cache.c:98
2	2	1 : View List ['remove']	2	2	check_architecture	call site: 00004	/src/binutils-gdb/binutils/fuzz_readelf.c:29
0	33	1 : View List ['bfd_seek']	0	33	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:283
0	16	2 : View List ['bfd_hash_table_free', 'bfd_set_error']	0	16	bfd_hash_table_init_n	call site: 00025	/src/binutils-gdb/bfd/hash.c:449
0	11	1 : View List ['bfd_set_error']	0	14	bfd_cache_delete	call site: 00079	/src/binutils-gdb/bfd/cache.c:168
0	11	1 : View List ['bfd_set_error']	0	11	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:277

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

975

Reachable functions

1005

Percentage of reachable functions covered

2.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_readelf.c	2
bfd/opncls.c	8
bfd/libbfd.c	3
bfd/bfd.c	4
libiberty/./objalloc.c	3
bfd/hash.c	4
bfd/section.c	1
bfd/./targets.c	2
bfd/./bfd.h	3
bfd/bfdio.c	4
bfd/cache.c	6
binutils/./dwarf.c	76
binutils/elfcomm.c	15
binutils/./readelf.h	257
binutils/../bfd/bfd.h	1
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./lbasename.c	2
binutils/./../include/elf/aarch64.h	1
binutils/./../include/elf/m32r.h	1
binutils/./../include/elf/i386.h	1
binutils/./../include/elf/m68hc11.h	1
binutils/./../include/elf/s12z.h	1
binutils/./../include/elf/m68k.h	1
binutils/./../include/elf/i960.h	1
binutils/./../include/elf/avr.h	1
binutils/./../include/elf/sparc.h	1
binutils/./../include/elf/spu.h	1
binutils/./../include/elf/v850.h	2
binutils/./../include/elf/d10v.h	1
binutils/./../include/elf/d30v.h	1
binutils/./../include/elf/dlx.h	1
binutils/./../include/elf/sh.h	1
binutils/./../include/elf/mn10300.h	1
binutils/./../include/elf/mn10200.h	1
binutils/./../include/elf/fr30.h	1
binutils/./../include/elf/frv.h	1
binutils/./../include/elf/csky.h	1
binutils/./../include/elf/ft32.h	1
binutils/./../include/elf/mcore.h	1
binutils/./../include/elf/mmix.h	1
binutils/./../include/elf/moxie.h	1
binutils/./../include/elf/msp430.h	2
binutils/./../include/elf/nds32.h	1
binutils/./../include/elf/ppc.h	1
binutils/./../include/elf/ppc64.h	2
binutils/./../include/elf/mips.h	1
binutils/./../include/elf/riscv.h	1
binutils/./../include/elf/alpha.h	1
binutils/./../include/elf/arm.h	1
binutils/./../include/elf/arc.h	1
binutils/./../include/elf/hppa.h	1
binutils/./../include/elf/h8.h	1
binutils/./../include/elf/or1k.h	1
binutils/./../include/elf/pj.h	1
binutils/./../include/elf/ia64.h	1
binutils/./../include/elf/kvx.h	1
binutils/./../include/elf/cris.h	1
binutils/./../include/elf/i860.h	1
binutils/./../include/elf/x86-64.h	1
binutils/./../include/elf/i370.h	1
binutils/./../include/elf/s390.h	1
binutils/./../include/elf/score.h	1
binutils/./../include/elf/xstormy16.h	1
binutils/./../include/elf/crx.h	1
binutils/./../include/elf/vax.h	1
binutils/./../include/elf/visium.h	1
binutils/./../include/elf/bpf.h	1
binutils/./../include/elf/epiphany.h	1
binutils/./../include/elf/ip2k.h	1
binutils/./../include/elf/iq2000.h	1
binutils/./../include/elf/xtensa.h	1
binutils/./../include/elf/lm32.h	1
binutils/./../include/elf/m32c.h	1
binutils/./../include/elf/mt.h	1
binutils/./../include/elf/bfin.h	1
binutils/./../include/elf/mep.h	1
binutils/./../include/elf/cr16.h	1
binutils/./../include/elf/microblaze.h	1
binutils/./../include/elf/rl78.h	1
binutils/./../include/elf/rx.h	1
binutils/./../include/elf/metag.h	1
binutils/./../include/elf/tic6x.h	1
binutils/./../include/elf/tilegx.h	1
binutils/./../include/elf/tilepro.h	1
binutils/./../include/elf/wasm32.h	1
binutils/./../include/elf/xgate.h	1
binutils/./../include/elf/nios2.h	1
binutils/./../include/elf/pru.h	1
binutils/./../include/elf/nfp.h	2
binutils/./../include/elf/z80.h	1
binutils/./../include/elf/loongarch.h	1
binutils/./../include/elf/amdgpu.h	1
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libctf/ctf-archive.c	15
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
libctf/ctf-open.c	30
libctf/ctf-subr.c	7
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	15
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-error.c	1
libsframe/sframe-dump.c	5

Fuzzer: fuzz_objcopy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3242	82.5%
gold	[1:9]	72	1.83%
yellow	[10:29]	47	1.19%
greenyellow	[30:49]	7	0.17%
lawngreen	50+	560	14.2%
All colors	3928	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
510	510	2 : View List ['try_load_plugin', 'build_plugin_list']	510	510	load_plugin	call site: 00000	/src/binutils-gdb/bfd/plugin.c:571
449	1520	8 : View List ['_bfd_append_relative_path', 'bfd_get_error', '_bfd_get_elt_at_filepos', 'open_nested_file', 'find_nested_archive', 'dgettext', 'bfd_check_format', 'bfd_set_error']	449	1706	_bfd_get_elt_at_filepos	call site: 00000	/src/binutils-gdb/bfd/archive.c:693
366	383	3 : View List ['bfd_malloc', 'bfd_set_section_alignment.121571', 'decompress_contents']	366	945	bfd_compress_section_contents	call site: 00000	/src/binutils-gdb/bfd/compress.c:596
359	359	1 : View List ['display_info']	359	359	copy_main	call site: 00448	/src/binutils-gdb/binutils/./fuzz_objcopy.h:5989
241	241	1 : View List ['_bfd_archive_64_bit_slurp_armap']	241	241	bfd_slurp_armap	call site: 00000	/src/binutils-gdb/bfd/archive.c:1217
236	236	2 : View List ['debug_get_real_type', 'debug_set_class_id']	236	236	debug_write_type	call site: 03613	/src/binutils-gdb/binutils/debug.c:2439
222	288	2 : View List ['aout_16_squirt_out_relocs', 'bfd_seek']	222	288	pdp11_aout_write_headers	call site: 00000	/src/binutils-gdb/bfd/pdp11.c:387
220	240	3 : View List ['ihex_scan', 'bfd_release', 'ihex_mkobject']	220	262	ihex_object_p	call site: 00000	/src/binutils-gdb/bfd/ihex.c:505
208	208	1 : View List ['bfd_fdopenw']	212	6675	copy_file	call site: 00781	/src/binutils-gdb/binutils/./fuzz_objcopy.h:3931
208	208	1 : View List ['bfd_fdopenw']	210	6461	copy_file	call site: 03875	/src/binutils-gdb/binutils/./fuzz_objcopy.h:3965
172	248	6 : View List ['bfd_get_symcount.98235', 'ecoff_set_symbol_info', 'bfd_set_error', 'bfd_alloc', 'dgettext', '_bfd_error_handler']	172	248	_bfd_ecoff_slurp_symbol_table	call site: 00000	/src/binutils-gdb/bfd/ecoff.c:901
128	128	1 : View List ['bfd_ecoff_write_debug']	128	323	_bfd_ecoff_write_object_contents	call site: 00000	/src/binutils-gdb/bfd/ecoff.c:2806

Runtime coverage analysis

Covered functions

1270

Functions that are reachable but not covered

497

Reachable functions

810

Percentage of reachable functions covered

38.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_objcopy.c	2
bfd/bfd.c	21
bfd/./bfd.h	22
binutils/bucomm.c	25
bfd/./targets.c	6
libiberty/./xexit.c	1
binutils/./fuzz_objcopy.h	64
libiberty/./hashtab.c	17
libiberty/./xmalloc.c	4
bfd/./archures.c	6
binutils/../bfd/bfd.h	25
libiberty/./xstrndup.c	1
libiberty/./xstrdup.c	1
bfd/libbfd.c	4
libiberty/./make-temp-file.c	4
bfd/opncls.c	14
libiberty/./objalloc.c	4
bfd/hash.c	9
bfd/section.c	12
bfd/cache.c	8
bfd/bfdio.c	9
libiberty/./unlink-if-ordinary.c	1
libiberty/./xstrerror.c	1
bfd/format.c	11
binutils/version.c	1
libiberty/./filename_cmp.c	1
bfd/archive.c	1
libiberty/./concat.c	3
bfd/compress.c	5
bfd/elf-properties.c	4
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
libiberty/./lbasename.c	2
binutils/rddbg.c	6
binutils/debug.c	70
binutils/stabs.c	51
libiberty/./cp-demint.c	1
libiberty/./cp-demangle.c	111
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./d-demangle.c	41
bfd/stab-syms.c	1
binutils/rdcoff.c	8
bfd/coff-bfd.c	2
bfd/syms.c	5
binutils/wrstabs.c	3
binutils/rename.c	5

Fuzzer: fuzz_readelf_elf32_littlearm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6635	99.3%
gold	[1:9]	44	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	6681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2223	2633	19 : View List ['bfd_header_big_endian.78178', 'bfd_set_start_address', 'bfd_default_set_arch_mach', '_bfd_elf_get_dynamic_symbols', 'bfd_elf32_swap_phdr_in', '_bfd_elf_setup_sections', 'bfd_get_file_size', 'elf_file_p.78177', 'bfd_header_little_endian.78179', 'bfd_read', 'dgettext', '_bfd_error_handler', 'bfd_section_from_elf_index', 'elf_swap_ehdr_in.78180', 'elf_swap_shdr_in.78185', 'bfd_alloc', 'bfd_section_from_shdr', 'bfd_seek', 'bfd_zalloc']	2223	2644	bfd_elf32_object_p	call site: 00000	/src/binutils-gdb/bfd/./elfcode.h:532
29	29	1 : View List ['close_one']	29	31	bfd_cache_init	call site: 00072	/src/binutils-gdb/bfd/cache.c:499
9	9	1 : View List ['_bfd_abort']	9	9	bfd_set_error	call site: 00009	/src/binutils-gdb/bfd/bfd.c:802
2	13	2 : View List ['close', 'bfd_set_error']	2	25	bfd_fopen	call site: 00051	/src/binutils-gdb/bfd/opncls.c:288
2	2	1 : View List ['fdopen']	8	144	bfd_fopen	call site: 00046	/src/binutils-gdb/bfd/opncls.c:283
2	2	1 : View List ['getenv']	4	26	bfd_find_target	call site: 00038	/src/binutils-gdb/bfd/./targets.c:1620
2	2	1 : View List ['sysconf']	2	2	bfd_cache_max_open	call site: 00073	/src/binutils-gdb/bfd/cache.c:98
2	2	1 : View List ['remove']	2	2	check_architecture	call site: 00004	/src/binutils-gdb/binutils/fuzz_readelf.c:29
0	33	1 : View List ['bfd_seek']	0	33	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:283
0	16	2 : View List ['bfd_hash_table_free', 'bfd_set_error']	0	16	bfd_hash_table_init_n	call site: 00025	/src/binutils-gdb/bfd/hash.c:449
0	11	1 : View List ['bfd_set_error']	0	14	bfd_cache_delete	call site: 00079	/src/binutils-gdb/bfd/cache.c:168
0	11	1 : View List ['bfd_set_error']	0	11	bfd_read	call site: 00000	/src/binutils-gdb/bfd/bfdio.c:277

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

975

Reachable functions

1005

Percentage of reachable functions covered

2.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_readelf.c	2
bfd/opncls.c	8
bfd/libbfd.c	3
bfd/bfd.c	4
libiberty/./objalloc.c	3
bfd/hash.c	4
bfd/section.c	1
bfd/./targets.c	2
bfd/./bfd.h	3
bfd/bfdio.c	4
bfd/cache.c	6
binutils/./dwarf.c	76
binutils/elfcomm.c	15
binutils/./readelf.h	257
binutils/../bfd/bfd.h	1
libiberty/./xstrdup.c	1
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
libiberty/./lbasename.c	2
binutils/./../include/elf/aarch64.h	1
binutils/./../include/elf/m32r.h	1
binutils/./../include/elf/i386.h	1
binutils/./../include/elf/m68hc11.h	1
binutils/./../include/elf/s12z.h	1
binutils/./../include/elf/m68k.h	1
binutils/./../include/elf/i960.h	1
binutils/./../include/elf/avr.h	1
binutils/./../include/elf/sparc.h	1
binutils/./../include/elf/spu.h	1
binutils/./../include/elf/v850.h	2
binutils/./../include/elf/d10v.h	1
binutils/./../include/elf/d30v.h	1
binutils/./../include/elf/dlx.h	1
binutils/./../include/elf/sh.h	1
binutils/./../include/elf/mn10300.h	1
binutils/./../include/elf/mn10200.h	1
binutils/./../include/elf/fr30.h	1
binutils/./../include/elf/frv.h	1
binutils/./../include/elf/csky.h	1
binutils/./../include/elf/ft32.h	1
binutils/./../include/elf/mcore.h	1
binutils/./../include/elf/mmix.h	1
binutils/./../include/elf/moxie.h	1
binutils/./../include/elf/msp430.h	2
binutils/./../include/elf/nds32.h	1
binutils/./../include/elf/ppc.h	1
binutils/./../include/elf/ppc64.h	2
binutils/./../include/elf/mips.h	1
binutils/./../include/elf/riscv.h	1
binutils/./../include/elf/alpha.h	1
binutils/./../include/elf/arm.h	1
binutils/./../include/elf/arc.h	1
binutils/./../include/elf/hppa.h	1
binutils/./../include/elf/h8.h	1
binutils/./../include/elf/or1k.h	1
binutils/./../include/elf/pj.h	1
binutils/./../include/elf/ia64.h	1
binutils/./../include/elf/kvx.h	1
binutils/./../include/elf/cris.h	1
binutils/./../include/elf/i860.h	1
binutils/./../include/elf/x86-64.h	1
binutils/./../include/elf/i370.h	1
binutils/./../include/elf/s390.h	1
binutils/./../include/elf/score.h	1
binutils/./../include/elf/xstormy16.h	1
binutils/./../include/elf/crx.h	1
binutils/./../include/elf/vax.h	1
binutils/./../include/elf/visium.h	1
binutils/./../include/elf/bpf.h	1
binutils/./../include/elf/epiphany.h	1
binutils/./../include/elf/ip2k.h	1
binutils/./../include/elf/iq2000.h	1
binutils/./../include/elf/xtensa.h	1
binutils/./../include/elf/lm32.h	1
binutils/./../include/elf/m32c.h	1
binutils/./../include/elf/mt.h	1
binutils/./../include/elf/bfin.h	1
binutils/./../include/elf/mep.h	1
binutils/./../include/elf/cr16.h	1
binutils/./../include/elf/microblaze.h	1
binutils/./../include/elf/rl78.h	1
binutils/./../include/elf/rx.h	1
binutils/./../include/elf/metag.h	1
binutils/./../include/elf/tic6x.h	1
binutils/./../include/elf/tilegx.h	1
binutils/./../include/elf/tilepro.h	1
binutils/./../include/elf/wasm32.h	1
binutils/./../include/elf/xgate.h	1
binutils/./../include/elf/nios2.h	1
binutils/./../include/elf/pru.h	1
binutils/./../include/elf/nfp.h	2
binutils/./../include/elf/z80.h	1
binutils/./../include/elf/loongarch.h	1
binutils/./../include/elf/amdgpu.h	1
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	110
libiberty/./d-demangle.c	41
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libctf/ctf-archive.c	15
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
libctf/ctf-open.c	30
libctf/ctf-subr.c	7
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	15
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-error.c	1
libsframe/sframe-dump.c	5

Fuzzer: fuzz_objdump

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8671	73.2%
gold	[1:9]	503	4.24%
yellow	[10:29]	245	2.06%
greenyellow	[30:49]	105	0.88%
lawngreen	50+	2316	19.5%
All colors	11840	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2077	2077	1 : View List ['dump_ctf']	6934	38442	dump_bfd	call site: 01366	/src/binutils-gdb/binutils/./fuzz_objdump.h:5675
1897	1897	1 : View List ['display_debug_lines_decoded']	1897	1897	display_debug_lines	call site: 00000	/src/binutils-gdb/binutils/./dwarf.c:5728
1841	1841	1 : View List ['dump_symbols']	8775	41034	dump_bfd	call site: 01366	/src/binutils-gdb/binutils/./fuzz_objdump.h:5668
1783	1783	1 : View List ['bfd_demangle']	1783	1833	objdump_print_symname	call site: 03943	/src/binutils-gdb/binutils/./fuzz_objdump.h:1302
1205	3357	14 : View List ['xcmalloc', 'introduce', 'load_debug_info', 'display_loclists_list', 'display_loc_list_dwo', 'free', 'error', 'reloc_at', 'putchar', 'display_loc_list', 'ngettext', 'qsort', 'display_offset_entry_loclists', 'display_view_pair_list']	1231	3427	display_debug_loc	call site: 00000	/src/binutils-gdb/binutils/./dwarf.c:7262
1009	2380	14 : View List ['bfd_tell', 'bfd_set_start_address', 'bfd_make_section_old_way', 'mmo_get_symbols', 'mmo_decide_section', 'bfd_malloc', 'mmo_get_loc', 'bfd_read', 'mmo_xore_16', 'mmo_get_spec_section', 'bfd_stat', 'mmo_xore_32', 'bfd_map_over_sections', 'mmo_xore_64']	1035	2808	mmo_scan	call site: 00000	/src/binutils-gdb/bfd/mmo.c:1650
988	988	1 : View List ['bfd_init_section_compress_status']	990	1016	_bfd_elf_make_section_from_shdr	call site: 00000	/src/binutils-gdb/bfd/elf.c:1220
988	988	1 : View List ['bfd_init_section_compress_status']	990	992	make_a_section_from_file	call site: 00000	/src/binutils-gdb/bfd/coffgen.c:249
954	954	1 : View List ['dump_section_sframe']	4857	36365	dump_bfd	call site: 01366	/src/binutils-gdb/binutils/./fuzz_objdump.h:5677
895	934	12 : View List ['xcmalloc', 'qsort', 'putchar', 'display_loc_list', 'ngettext', 'display_loclists_list', 'display_loc_list_dwo', 'free', 'error', 'reloc_at', 'introduce', 'display_view_pair_list']	917	992	display_debug_loc	call site: 00000	/src/binutils-gdb/binutils/./dwarf.c:7289
663	701	15 : View List ['qsort', 'xtensa_get_property_predef_flags', 'retrieve_internal_relocs', 'bfd_assert', 'get_elf_r_symndx_offset.110149', 'bfd_malloc', 'get_elf_r_symndx_section.110146', 'dgettext', 'retrieve_contents', '_bfd_error_handler', 'bfd_get_section_limit.110022', 'free', 'release_contents', 'release_internal_relocs', 'bfd_set_error']	663	701	xtensa_read_table_entries	call site: 09140	/src/binutils-gdb/bfd/elf32-xtensa.c:889
554	556	4 : View List ['print_got_plt', 'private_data.19147', 'bfd_get_file_flags', 'bfd_asymbol_name.19041']	554	556	print_insn_powerpc	call site: 00000	/src/binutils-gdb/opcodes/ppc-dis.c:1178

Runtime coverage analysis

Covered functions

2640

Functions that are reachable but not covered

1129

Reachable functions

1954

Percentage of reachable functions covered

42.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
binutils/fuzz_objdump.c	2
binutils/./dwarf.c	67
binutils/elfcomm.c	5
binutils/./fuzz_objdump.h	87
binutils/bucomm.c	8
bfd/opncls.c	8
bfd/libbfd.c	13
bfd/bfd.c	19
libiberty/./objalloc.c	4
bfd/hash.c	9
bfd/section.c	8
bfd/./targets.c	3
bfd/./bfd.h	14
bfd/bfdio.c	9
bfd/cache.c	8
libiberty/./xstrerror.c	1
bfd/format.c	10
libiberty/./unlink-if-ordinary.c	1
binutils/../bfd/bfd.h	20
libiberty/./xmalloc.c	4
libiberty/./xexit.c	1
bfd/archive.c	1
bfd/simple.c	13
bfd/compress.c	3
zlib/inflate.c	10
zlib/zutil.c	3
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/linker.c	4
binutils/./dwarf.h	1
libiberty/./../include/dwarf2.def	4
libiberty/./concat.c	3
libiberty/./lrealpath.c	1
libiberty/./xstrdup.c	1
binutils/filemode.c	3
bfd/./archures.c	6
libiberty/./cplus-dem.c	2
libiberty/./rust-demangle.c	32
libiberty/./cp-demangle.c	111
libiberty/./d-demangle.c	41
libctf/ctf-open-bfd.c	1
libctf/ctf-subr.c	7
libctf/ctf-archive.c	16
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	1
bfd/elf.c	3
bfd/./libbfd.h	1
libctf/./../bfd/bfd.h	1
libctf/ctf-open.c	30
libctf/ctf-util.c	13
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libctf/ctf-error.c	2
zlib/uncompr.c	2
libctf/ctf-string.c	10
libctf/ctf-hash.c	20
libiberty/./hashtab.c	18
libctf/./ctf-inlines.h	2
libctf/ctf-create.c	5
libctf/ctf-serialize.c	1
libctf/ctf-dedup.c	1
libiberty/./bsearch_r.c	1
libctf/ctf-dump.c	14
libctf/ctf-labels.c	2
libctf/ctf-types.c	23
libctf/ctf-decl.c	5
libctf/ctf-lookup.c	3
libsframe/sframe.c	40
libsframe/sframe-dump.c	5
bfd/stab-syms.c	1
libiberty/./filename_cmp.c	1
opcodes/dis-init.c	1
opcodes/./disassemble.c	6
opcodes/alpha-dis.c	1
opcodes/arc-dis.c	1
opcodes/arc-ext.c	3
opcodes/../bfd/bfd.h	8
opcodes/avr-dis.c	3
opcodes/bfin-dis.c	51
opcodes/cr16-dis.c	22
opcodes/cris-dis.c	20
opcodes/crx-dis.c	19
opcodes/csky-dis.c	1
opcodes/d10v-dis.c	4
opcodes/d10v-opc.c	1
opcodes/d30v-dis.c	4
opcodes/d30v-opc.c	1
opcodes/dlx-dis.c	8
opcodes/h8300-dis.c	7
opcodes/hppa-dis.c	20
opcodes/../bfd/libhppa.h	2
opcodes/i386-dis.c	32
opcodes/ia64-dis.c	2
opcodes/ia64-opc.c	8
opcodes/ip2k-dis.c	15
opcodes/cgen-bitset.c	10
opcodes/ip2k-desc.c	8
opcodes/ip2k-opc.c	8
opcodes/ip2k-asm.c	1
libiberty/./regex.c	15
opcodes/ip2k-ibld.c	9
opcodes/cgen-opc.c	9
opcodes/cgen-dis.c	6
opcodes/bpf-dis.c	4
opcodes/bpf-opc.c	7
opcodes/epiphany-dis.c	12
opcodes/epiphany-desc.c	8
opcodes/epiphany-opc.c	6
opcodes/epiphany-asm.c	1
opcodes/epiphany-ibld.c	9
opcodes/fr30-dis.c	15
opcodes/fr30-desc.c	8
opcodes/fr30-opc.c	6
opcodes/fr30-asm.c	1
opcodes/fr30-ibld.c	12
opcodes/kvx-dis.c	11
opcodes/lm32-dis.c	9
opcodes/lm32-desc.c	8
opcodes/lm32-opc.c	6
opcodes/lm32-asm.c	1
opcodes/lm32-ibld.c	9
opcodes/m32r-dis.c	12
opcodes/m32r-desc.c	8
opcodes/m32r-opc.c	7
opcodes/m32r-asm.c	1
opcodes/m32r-ibld.c	9
opcodes/m68hc11-dis.c	7
opcodes/s12z-dis.c	7
opcodes/s12z-opc.c	2
opcodes/m68k-dis.c	12
bfd/cpu-m68k.c	1
libiberty/./floatformat.c	3
opcodes/mt-dis.c	10
opcodes/mt-desc.c	8
opcodes/mt-opc.c	8
opcodes/mt-asm.c	1
opcodes/mt-ibld.c	9
opcodes/microblaze-dis.c	9
opcodes/msp430-dis.c	11
opcodes/nds32-dis.c	16
opcodes/nfp-dis.c	51
opcodes/./../include/dis-asm.h	1
opcodes/ns32k-dis.c	13
opcodes/mcore-dis.c	1
opcodes/mep-dis.c	17
opcodes/mep-desc.c	8
opcodes/mep-opc.c	8
opcodes/mep-asm.c	1
opcodes/mep-ibld.c	9
opcodes/metag-dis.c	1
opcodes/mips-dis.c	29
bfd/elfxx-mips.c	1
opcodes/./../include/opcode/mips.h	8
opcodes/mips16-opc.c	1
opcodes/micromips-opc.c	1
opcodes/mips-opc.c	1
opcodes/mmix-dis.c	5
opcodes/m10200-dis.c	2
opcodes/m10300-dis.c	2
opcodes/nios2-dis.c	10
opcodes/or1k-dis.c	10
opcodes/or1k-desc.c	8
opcodes/or1k-opc.c	7
opcodes/or1k-asm.c	1
opcodes/or1k-ibld.c	9
opcodes/pdp11-dis.c	7
opcodes/pj-dis.c	2
opcodes/ppc-dis.c	8
opcodes/pru-dis.c	5
opcodes/riscv-dis.c	3
bfd/cpu-riscv.c	2
bfd/elfxx-riscv.c	16
opcodes/rl78-dis.c	8
opcodes/rl78-decode.opc	3
opcodes/rx-dis.c	12
opcodes/rx-decode.opc	3
opcodes/s390-dis.c	7
opcodes/score-dis.c	7
opcodes/score7-dis.c	4
opcodes/./sh-dis.c	5
bfd/cpu-sh.c	1
opcodes/sparc-dis.c	5
opcodes/sparc-opc.c	5
opcodes/spu-dis.c	3
opcodes/tic30-dis.c	9
opcodes/tic4x-dis.c	15
opcodes/tic54x-dis.c	12
opcodes/tic6x-dis.c	7
opcodes/ft32-dis.c	4
opcodes/./../include/opcode/ft32.h	1
opcodes/v850-dis.c	11
opcodes/wasm32-dis.c	7
opcodes/xgate-dis.c	6
opcodes/xstormy16-dis.c	8
opcodes/xstormy16-desc.c	8
opcodes/xstormy16-opc.c	6
opcodes/xstormy16-asm.c	1
opcodes/xstormy16-ibld.c	9
opcodes/xtensa-dis.c	6
bfd/xtensa-isa.c	29
bfd/xtensa-dynconfig.c	1
bfd/elf32-xtensa.c	19
bfd/elflink.c	3
opcodes/z80-dis.c	4
opcodes/z8k-dis.c	10
opcodes/vax-dis.c	7
opcodes/visium-dis.c	6
opcodes/frv-dis.c	13
opcodes/frv-desc.c	8
opcodes/frv-opc.c	6
opcodes/frv-asm.c	1
opcodes/frv-ibld.c	9
opcodes/moxie-dis.c	1
opcodes/iq2000-dis.c	9
opcodes/iq2000-desc.c	8
opcodes/iq2000-opc.c	6
opcodes/iq2000-asm.c	2
opcodes/iq2000-ibld.c	9
opcodes/m32c-dis.c	23
opcodes/m32c-desc.c	8
opcodes/m32c-opc.c	7
opcodes/m32c-asm.c	2
opcodes/m32c-ibld.c	12
opcodes/tilegx-dis.c	1
opcodes/tilegx-opc.c	4
opcodes/tilepro-dis.c	2
opcodes/tilepro-opc.c	4
opcodes/loongarch-dis.c	7
opcodes/loongarch-coder.c	6
opcodes/loongarch-opc.c	1
bfd/syms.c	1
libiberty/./lbasename.c	2
binutils/rddbg.c	6
binutils/debug.c	70
binutils/stabs.c	51
libiberty/./cp-demint.c	1
binutils/rdcoff.c	8
bfd/coff-bfd.c	2
binutils/prdbg.c	1

Fuzzer: fuzz_disas_ext-bfd_arch_mips

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6903	98.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	1.73%
All colors	7025	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['bfd_getb16']	4	631	print_insn_mips16	call site: 03547	/src/binutils-gdb/opcodes/mips-dis.c:2336
2	2	1 : View List ['bfd_getb16']	2	1101	print_insn_micromips	call site: 03598	/src/binutils-gdb/opcodes/mips-dis.c:2545
2	2	1 : View List ['abort']	2	2	print_vu0_channel	call site: 03592	/src/binutils-gdb/opcodes/mips-dis.c:1304
0	1261	1 : View List ['print_insn_micromips']	0	1261	_print_insn_mips	call site: 03620	/src/binutils-gdb/opcodes/mips-dis.c:2690
0	301	1 : View List ['print_insn_mips16']	0	301	_print_insn_mips	call site: 03623	/src/binutils-gdb/opcodes/mips-dis.c:2692
0	4	2 : View List ['bfd_getb32', 'bfd_getl32']	6	641	print_insn_mips16	call site: 03542	/src/binutils-gdb/opcodes/mips-dis.c:2295
0	0	None	6	635	print_insn_mips16	call site: 03545	/src/binutils-gdb/opcodes/mips-dis.c:2327
0	0	None	6	120	print_mips16_insn_arg	call site: 03564	/src/binutils-gdb/opcodes/mips-dis.c:2137
0	0	None	4	1105	print_insn_micromips	call site: 03596	/src/binutils-gdb/opcodes/mips-dis.c:2527
0	0	None	2	584	print_insn_mips16	call site: 03562	/src/binutils-gdb/opcodes/mips-dis.c:2453
0	0	None	2	2	perror_memory	call site: 00000	/src/binutils-gdb/opcodes/dis-buf.c:59
0	0	None	0	22831	disassemble_architecture	call site: 00005	/src/binutils-gdb/fuzz/fuzz_disas_ext.c:88

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

1015

Reachable functions

1067

Percentage of reachable functions covered

4.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_disas_ext.c	4
opcodes/dis-init.c	1
bfd/libbfd.c	12
bfd/./archures.c	4
opcodes/./disassemble.c	5
opcodes/alpha-dis.c	1
opcodes/arc-dis.c	1
opcodes/arc-ext.c	3
opcodes/../bfd/bfd.h	8
libiberty/./xmalloc.c	3
libiberty/./xexit.c	1
bfd/section.c	5
bfd/./bfd.h	7
bfd/bfd.c	5
libiberty/./xstrdup.c	1
opcodes/avr-dis.c	3
opcodes/bfin-dis.c	51
opcodes/cr16-dis.c	22
opcodes/cris-dis.c	20
opcodes/crx-dis.c	19
opcodes/csky-dis.c	1
bfd/hash.c	4
libiberty/./objalloc.c	2
opcodes/d10v-dis.c	4
opcodes/d10v-opc.c	1
opcodes/d30v-dis.c	4
opcodes/d30v-opc.c	1
opcodes/dlx-dis.c	8
opcodes/h8300-dis.c	7
opcodes/hppa-dis.c	20
opcodes/../bfd/libhppa.h	2
opcodes/i386-dis.c	32
opcodes/ia64-dis.c	2
opcodes/ia64-opc.c	8
opcodes/ip2k-dis.c	15
opcodes/cgen-bitset.c	10
opcodes/ip2k-desc.c	8
opcodes/ip2k-opc.c	8
opcodes/ip2k-asm.c	1
libiberty/./regex.c	15
opcodes/ip2k-ibld.c	9
opcodes/cgen-opc.c	9
opcodes/cgen-dis.c	6
opcodes/bpf-dis.c	4
opcodes/bpf-opc.c	7
opcodes/epiphany-dis.c	12
opcodes/epiphany-desc.c	8
opcodes/epiphany-opc.c	6
opcodes/epiphany-asm.c	1
opcodes/epiphany-ibld.c	9
opcodes/fr30-dis.c	15
opcodes/fr30-desc.c	8
opcodes/fr30-opc.c	6
opcodes/fr30-asm.c	1
opcodes/fr30-ibld.c	12
opcodes/kvx-dis.c	11
opcodes/lm32-dis.c	9
opcodes/lm32-desc.c	8
opcodes/lm32-opc.c	6
opcodes/lm32-asm.c	1
opcodes/lm32-ibld.c	9
opcodes/m32r-dis.c	12
opcodes/m32r-desc.c	8
opcodes/m32r-opc.c	7
opcodes/m32r-asm.c	1
opcodes/m32r-ibld.c	9
opcodes/m68hc11-dis.c	7
opcodes/s12z-dis.c	7
opcodes/s12z-opc.c	2
opcodes/m68k-dis.c	12
bfd/cpu-m68k.c	1
libiberty/./floatformat.c	3
opcodes/mt-dis.c	10
opcodes/mt-desc.c	8
opcodes/mt-opc.c	8
opcodes/mt-asm.c	1
opcodes/mt-ibld.c	9
opcodes/microblaze-dis.c	9
opcodes/msp430-dis.c	11
opcodes/nds32-dis.c	16
libiberty/./hashtab.c	12
opcodes/nfp-dis.c	51
opcodes/./../include/dis-asm.h	1
opcodes/ns32k-dis.c	13
opcodes/mcore-dis.c	1
opcodes/mep-dis.c	17
opcodes/mep-desc.c	8
opcodes/mep-opc.c	8
opcodes/mep-asm.c	1
opcodes/mep-ibld.c	9
opcodes/metag-dis.c	1
opcodes/mips-dis.c	29
bfd/elfxx-mips.c	1
opcodes/./../include/opcode/mips.h	8
opcodes/mips16-opc.c	1
opcodes/micromips-opc.c	1
opcodes/mips-opc.c	1
opcodes/mmix-dis.c	5
opcodes/m10200-dis.c	2
opcodes/m10300-dis.c	2
opcodes/nios2-dis.c	10
opcodes/or1k-dis.c	10
opcodes/or1k-desc.c	8
opcodes/or1k-opc.c	7
opcodes/or1k-asm.c	1
opcodes/or1k-ibld.c	9
opcodes/pdp11-dis.c	7
opcodes/pj-dis.c	2
opcodes/ppc-dis.c	8
opcodes/pru-dis.c	5
opcodes/riscv-dis.c	3
bfd/cpu-riscv.c	2
bfd/elfxx-riscv.c	16
opcodes/rl78-dis.c	8
opcodes/rl78-decode.opc	3
opcodes/rx-dis.c	12
opcodes/rx-decode.opc	3
opcodes/s390-dis.c	7
opcodes/score-dis.c	7
opcodes/score7-dis.c	4
opcodes/./sh-dis.c	5
bfd/cpu-sh.c	1
opcodes/sparc-dis.c	5
opcodes/sparc-opc.c	5
opcodes/spu-dis.c	3
opcodes/tic30-dis.c	9
opcodes/tic4x-dis.c	15
opcodes/tic54x-dis.c	12
opcodes/tic6x-dis.c	7
opcodes/ft32-dis.c	4
opcodes/./../include/opcode/ft32.h	1
opcodes/v850-dis.c	11
opcodes/wasm32-dis.c	7
opcodes/xgate-dis.c	6
opcodes/xstormy16-dis.c	8
opcodes/xstormy16-desc.c	8
opcodes/xstormy16-opc.c	6
opcodes/xstormy16-asm.c	1
opcodes/xstormy16-ibld.c	9
opcodes/xtensa-dis.c	6
bfd/xtensa-isa.c	29
bfd/xtensa-dynconfig.c	1
bfd/elf32-xtensa.c	19
bfd/compress.c	3
bfd/bfdio.c	5
zlib/inflate.c	10
zlib/zutil.c	2
zlib/crc32.c	5
zlib/adler32.c	2
zlib/inftrees.c	1
zlib/inffast.c	1
bfd/elflink.c	3
bfd/elf.c	2
opcodes/z80-dis.c	4
opcodes/z8k-dis.c	10
opcodes/vax-dis.c	7
opcodes/visium-dis.c	6
opcodes/frv-dis.c	13
opcodes/frv-desc.c	8
opcodes/frv-opc.c	6
opcodes/frv-asm.c	1
opcodes/frv-ibld.c	9
opcodes/moxie-dis.c	1
opcodes/iq2000-dis.c	9
opcodes/iq2000-desc.c	8
opcodes/iq2000-opc.c	6
opcodes/iq2000-asm.c	2
opcodes/iq2000-ibld.c	9
opcodes/m32c-dis.c	23
opcodes/m32c-desc.c	8
opcodes/m32c-opc.c	7
opcodes/m32c-asm.c	2
opcodes/m32c-ibld.c	12
opcodes/tilegx-dis.c	1
opcodes/tilegx-opc.c	4
opcodes/tilepro-dis.c	2
opcodes/tilepro-opc.c	4
opcodes/loongarch-dis.c	7
opcodes/loongarch-coder.c	6
opcodes/loongarch-opc.c	1