High level conclusions

Fuzzers reach 52.02% of cyclomatic complexity.

Fuzzers reach 43.37% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

481/1109

Cyclomatic complexity statically reachable by fuzzers

3123/6003

Runtime code coverage of functions

508 / 1109

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	295	22.3%
gold	[1:9]	81	6.14%
yellow	[10:29]	111	8.41%
greenyellow	[30:49]	42	3.18%
lawngreen	50+	790	59.8%
All colors	1319	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
73	75	2 : View List ['boost::source_location::source_location(char const*, unsigned int, char const*, unsigned int)', 'boost::json::detail::throw_length_error(char const*, boost::source_location const&)']	73	75	boost::json::detail::string_impl::growth(unsignedlong,unsignedlong)	call site: 00000	/src/boost/./boost/json/detail/impl/string_impl.ipp:123
73	75	2 : View List ['boost::source_location::source_location(char const*, unsigned int, char const*, unsigned int)', 'boost::json::detail::throw_length_error(char const*, boost::source_location const&)']	73	75	boost::json::array::table::allocate(unsignedlong,boost::json::storage_ptrconst&)	call site: 00000	/src/boost/./boost/json/impl/array.ipp:42
0	51	1 : View List ['boost::json::detail::handler::on_uint64(unsigned long, boost::core::basic_string_view , boost::system::error_code&)']	11	70	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2621
0	30	1 : View List ['boost::json::basic_parser ::suspend(char const*, boost::json::basic_parser ::state)']	0	32	charconst*boost::json::basic_parser ::parse_document (charconst*,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:561
0	30	1 : View List ['boost::json::basic_parser ::suspend(char const*, boost::json::basic_parser ::state)']	0	32	charconst*boost::json::basic_parser ::parse_comment (charconst*,std::__1::integral_constant ,bool)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:448
0	23	2 : View List ['boost::json::serializer::suspend(boost::json::serializer::state)', 'boost::json::detail::const_stream::skip(unsigned long)']	0	31	boolboost::json::serializer::write_number (boost::json::detail::stream&)	call site: 00000	/src/boost/./boost/json/impl/serializer.ipp:457
0	12	6 : View List ['unsigned int& boost::json::detail::access::next (boost::json::key_value_pair&)', 'boost::core::basic_string_view ::end() const', 'std::__1::pair ::pair ()', 'boost::core::basic_string_view ::begin() const', 'unsigned long boost::json::detail::digest (char const*, char const*, unsigned long)', 'boost::json::object::table::bucket(unsigned long)']	0	23	std::__1::pair boost::json::detail::find_in_object >(boost::json::objectconst&,boost::core::basic_string_view )	call site: 00000	/src/boost/./boost/json/impl/object.ipp:36
0	2	1 : View List ['boost::json::detail::string_impl::max_size()']	0	2	boost::json::detail::string_impl::growth(unsignedlong,unsignedlong)	call site: 00000	/src/boost/./boost/json/detail/impl/string_impl.ipp:126
0	0	None	77	611	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2091
0	0	None	35	157	charconst*boost::json::basic_parser ::parse_comment (charconst*,std::__1::integral_constant ,bool)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:462
0	0	None	33	134	charconst*boost::json::basic_parser ::parse_comment (charconst*,std::__1::integral_constant ,bool)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:431
0	0	None	0	3107	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2704

Runtime coverage analysis

Covered functions

452

Functions that are reachable but not covered

134

Reachable functions

821

Percentage of reachable functions covered

83.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/boost/libs/json/fuzzing/fuzz_parser.cpp	6
/work/stage/include/boost/json/parse_options.hpp	1
/work/stage/include/boost/core/detail/string_view.hpp	4
/work/stage/include/boost/json/storage_ptr.hpp	7
/src/boost/./boost/json/impl/stream_parser.ipp	8
/src/boost/./boost/json/basic_parser_impl.hpp	38
/src/boost/./boost/json/detail/impl/handler.ipp	19
/src/boost/./boost/json/storage_ptr.hpp	6
/src/boost/./boost/json/detail/config.hpp	1
/src/boost/./boost/json/impl/value_stack.ipp	38
/work/stage/include/boost/system/detail/error_code.hpp	4
/src/boost/./boost/json/detail/stack.hpp	7
/src/boost/./boost/json/basic_parser.hpp	3
/src/boost/./boost/json/impl/value.ipp	1
/src/boost/./boost/json/value.hpp	6
/src/boost/./boost/json/detail/value.hpp	5
/src/boost/./boost/json/string.hpp	5
/src/boost/./boost/json/detail/string_impl.hpp	5
/src/boost/./boost/json/detail/default_resource.hpp	1
/src/boost/./boost/container/pmr/memory_resource.hpp	4
/src/boost/./boost/json/impl/array.ipp	3
/src/boost/./boost/json/impl/array.hpp	3
/src/boost/./boost/json/impl/object.ipp	3
/src/boost/./boost/json/impl/object.hpp	5
/src/boost/./boost/json/pilfer.hpp	1
/work/stage/include/boost/json/stream_parser.hpp	2
/src/boost/./boost/system/detail/error_code.hpp	9
/src/boost/./boost/json/impl/error.ipp	1
/src/boost/./boost/system/detail/error_category.hpp	1
/src/boost/./boost/json/detail/stream.hpp	18
/src/boost/./boost/json/detail/sse2.hpp	5
/src/boost/./boost/json/detail/impl/stack.ipp	3
/src/boost/./boost/json/detail/utf8.hpp	12
/src/boost/./boost/json/detail/buffer.hpp	9
/src/boost/./boost/json/impl/string.ipp	1
/src/boost/./boost/json/detail/impl/string_impl.ipp	2
/src/boost/./boost/assert/source_location.hpp	6
/src/boost/./boost/json/detail/impl/except.ipp	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/boost/./boost/throw_exception.hpp	5
/src/boost/./boost/exception/exception.hpp	8
/src/boost/./boost/json/detail/object.hpp	1
/src/boost/./boost/json/detail/array.hpp	1
/src/boost/./boost/json/detail/impl/array.hpp	1
/src/boost/./boost/system/system_error.hpp	2
/work/stage/include/boost/system/detail/system_category_message.hpp	1
/work/stage/include/boost/system/detail/generic_category_message.hpp	3
/src/boost/./boost/system/detail/system_category.hpp	1
/src/boost/./boost/system/detail/interop_category.hpp	1
/src/boost/./boost/system/detail/append_int.hpp	1
/work/stage/include/boost/system/detail/snprintf.hpp	1
/src/boost/./boost/json/impl/serialize.ipp	2
/src/boost/./boost/json/impl/serializer.ipp	5
/src/boost/./boost/json/serializer.hpp	2
/work/stage/include/boost/json/basic_parser.hpp	1
/work/stage/include/boost/json/detail/handler.hpp	1
/src/boost/./boost/json/impl/null_resource.ipp	2
/src/boost/./boost/json/impl/static_resource.ipp	2

Fuzzer: fuzz_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	435	33.8%
gold	[1:9]	57	4.43%
yellow	[10:29]	107	8.32%
greenyellow	[30:49]	23	1.78%
lawngreen	50+	664	51.6%
All colors	1286	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
75	75	2 : View List ['boost::source_location::source_location(char const*, unsigned int, char const*, unsigned int)', 'boost::json::detail::throw_length_error(char const*, boost::source_location const&)']	75	75	boost::json::detail::string_impl::growth(unsignedlong,unsignedlong)	call site: 00000	/src/boost/./boost/json/detail/impl/string_impl.ipp:123
75	75	2 : View List ['boost::source_location::source_location(char const*, unsigned int, char const*, unsigned int)', 'boost::json::detail::throw_length_error(char const*, boost::source_location const&)']	75	75	boost::json::array::table::allocate(unsignedlong,boost::json::storage_ptrconst&)	call site: 00000	/src/boost/./boost/json/impl/array.ipp:42
30	30	1 : View List ['boost::json::basic_parser ::suspend(char const*, boost::json::basic_parser ::state)']	30	32	charconst*boost::json::basic_parser ::parse_document (charconst*,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:561
11	11	1 : View List ['char const* boost::json::detail::count_valid (char const*, char const*)']	55	1048	charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:1029
11	11	1 : View List ['char const* boost::json::detail::count_valid (char const*, char const*)']	55	933	charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:1029
0	51	1 : View List ['boost::json::detail::handler::on_uint64(unsigned long, boost::core::basic_string_view , boost::system::error_code&)']	11	70	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2621
0	12	6 : View List ['unsigned int& boost::json::detail::access::next (boost::json::key_value_pair&)', 'boost::core::basic_string_view ::end() const', 'std::__1::pair ::pair ()', 'boost::core::basic_string_view ::begin() const', 'unsigned long boost::json::detail::digest (char const*, char const*, unsigned long)', 'boost::json::object::table::bucket(unsigned long)']	0	23	std::__1::pair boost::json::detail::find_in_object >(boost::json::objectconst&,boost::core::basic_string_view )	call site: 00000	/src/boost/./boost/json/impl/object.ipp:36
0	2	1 : View List ['boost::json::detail::string_impl::max_size()']	0	2	boost::json::detail::string_impl::growth(unsignedlong,unsignedlong)	call site: 00000	/src/boost/./boost/json/detail/impl/string_impl.ipp:126
0	0	None	1726	3107	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2704
0	0	None	227	611	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2091
0	0	None	2	6	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/src/boost/./boost/json/basic_parser_impl.hpp:2752
0	0	None	0	35	boost::json::parser::release()	call site: 00000	/src/boost/./boost/json/impl/parser.ipp:147

Runtime coverage analysis

Covered functions

288

Functions that are reachable but not covered

204

Reachable functions

761

Percentage of reachable functions covered

73.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/boost/libs/json/fuzzing/fuzz_parse.cpp	2
/work/stage/include/boost/core/detail/string_view.hpp	1
/work/stage/include/boost/system/detail/error_code.hpp	4
/work/stage/include/boost/json/storage_ptr.hpp	5
/src/boost/./boost/json/impl/parse.ipp	1
/src/boost/./boost/json/parser.hpp	3
/src/boost/./boost/json/storage_ptr.hpp	7
/src/boost/./boost/json/detail/config.hpp	1
/src/boost/./boost/json/impl/parser.ipp	5
/src/boost/./boost/json/basic_parser_impl.hpp	37
/src/boost/./boost/json/detail/impl/handler.ipp	19
/src/boost/./boost/json/impl/value_stack.ipp	39
/src/boost/./boost/json/detail/stack.hpp	7
/src/boost/./boost/json/basic_parser.hpp	5
/src/boost/./boost/json/impl/value.ipp	1
/work/stage/include/boost/json/value.hpp	2
/src/boost/./boost/json/detail/value.hpp	5
/src/boost/./boost/json/string.hpp	5
/src/boost/./boost/json/detail/string_impl.hpp	5
/src/boost/./boost/json/detail/default_resource.hpp	1
/src/boost/./boost/container/pmr/memory_resource.hpp	2
/src/boost/./boost/json/impl/array.ipp	3
/src/boost/./boost/json/impl/array.hpp	3
/src/boost/./boost/json/impl/object.ipp	3
/src/boost/./boost/json/impl/object.hpp	5
/src/boost/./boost/json/value.hpp	7
/src/boost/./boost/json/pilfer.hpp	4
/src/boost/./boost/core/detail/string_view.hpp	2
/src/boost/./boost/system/detail/error_code.hpp	9
/src/boost/./boost/json/impl/error.ipp	1
/src/boost/./boost/system/detail/error_category.hpp	1
/src/boost/./boost/json/detail/stream.hpp	16
/src/boost/./boost/json/detail/sse2.hpp	5
/src/boost/./boost/json/detail/impl/stack.ipp	2
/src/boost/./boost/json/detail/utf8.hpp	12
/src/boost/./boost/json/detail/buffer.hpp	9
/src/boost/./boost/json/impl/string.ipp	1
/src/boost/./boost/json/detail/impl/string_impl.ipp	2
/src/boost/./boost/assert/source_location.hpp	6
/src/boost/./boost/json/detail/impl/except.ipp	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/boost/./boost/throw_exception.hpp	5
/src/boost/./boost/exception/exception.hpp	8
/src/boost/./boost/json/detail/object.hpp	1
/src/boost/./boost/json/detail/array.hpp	1
/src/boost/./boost/json/detail/impl/array.hpp	1
/src/boost/./boost/json/detail/handler.hpp	1
/src/boost/./boost/system/system_error.hpp	2
/work/stage/include/boost/system/detail/system_category_message.hpp	1
/work/stage/include/boost/system/detail/generic_category_message.hpp	3
/src/boost/./boost/system/detail/system_category.hpp	1
/src/boost/./boost/system/detail/interop_category.hpp	1
/src/boost/./boost/system/detail/append_int.hpp	1
/work/stage/include/boost/system/detail/snprintf.hpp	1

Fuzzer: fuzz_basic_parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	361	34.7%
gold	[1:9]	49	4.71%
yellow	[10:29]	108	10.3%
greenyellow	[30:49]	25	2.40%
lawngreen	50+	497	47.7%
All colors	1040	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	1 : View List ['boost::json::basic_parser ::suspend(char const*, boost::json::basic_parser ::state)']	32	34	charconst*boost::json::basic_parser ::parse_document (charconst*,std::__1::integral_constant )	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:561
11	11	1 : View List ['char const* boost::json::detail::count_valid (char const*, char const*)']	55	505	charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:1029
11	11	1 : View List ['char const* boost::json::detail::count_valid (char const*, char const*)']	55	505	charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:1029
0	2	1 : View List ['null_parser::handler::on_uint64(unsigned long, boost::core::basic_string_view , boost::system::error_code&)']	11	21	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:2621
0	0	None	1199	2056	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:2704
0	0	None	237	574	charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:2091
0	0	None	4	8	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:2752
0	0	None	0	0	boost::system::detail::failed_impl(int,boost::system::error_categoryconst&)	call site: 00000	/src/boost/./boost/system/detail/error_category.hpp:211
0	0	None	0	0	boost::json::basic_parser ::write_some(bool,charconst*,unsignedlong,boost::system::error_code&)	call site: 00000	/work/stage/include/boost/json/basic_parser_impl.hpp:2712
0	0	1 : View List ['std::__1::error_code::value() const']	0	0	boost::system::error_code::failed()const	call site: 00000	/work/stage/include/boost/system/detail/error_code.hpp:324

Runtime coverage analysis

Covered functions

113

Functions that are reachable but not covered

94

Reachable functions

310

Percentage of reachable functions covered

69.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/boost/libs/json/fuzzing/fuzz_basic_parser.cpp	23
/work/stage/include/boost/core/detail/string_view.hpp	2
/work/stage/include/boost/json/parse_options.hpp	1
/work/stage/include/boost/json/basic_parser_impl.hpp	35
/work/stage/include/boost/system/detail/error_code.hpp	5
/work/stage/include/boost/json/detail/stack.hpp	6
/work/stage/include/boost/json/storage_ptr.hpp	1
/src/boost/./boost/json/impl/error.ipp	1
/src/boost/./boost/system/detail/error_code.hpp	1
/src/boost/./boost/system/detail/error_category.hpp	1
/work/stage/include/boost/json/detail/stream.hpp	16
/work/stage/include/boost/json/detail/sse2.hpp	5
/work/stage/include/boost/json/basic_parser.hpp	2
/src/boost/./boost/json/detail/impl/stack.ipp	2
/src/boost/./boost/json/storage_ptr.hpp	6
/src/boost/./boost/json/detail/default_resource.hpp	1
/src/boost/./boost/container/pmr/memory_resource.hpp	2
/work/stage/include/boost/json/detail/utf8.hpp	12
/work/stage/include/boost/json/detail/buffer.hpp	10

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
boolboost::json::serializer::write_object (boost::json::detail::stream&)	/src/boost/./boost/json/impl/serializer.ipp	2	['class.boost::json::serializer *', 'class.boost::json::detail::const_stream *']	6	0	321	54	53	213	3	688	651
boost::json::value::set_at_pointer(boost::core::basic_string_view ,boost::json::value_ref,std::__1::error_code&,boost::json::set_pointer_optionsconst&)	/src/boost/./boost/json/impl/pointer.ipp	6	['class.boost::json::value *', 'char *', 'size_t ', 'class.boost::json::value_ref *', 'class.std::__1::error_code *', 'struct.boost::json::set_pointer_options *']	11	0	64	3	2	496	0	907	575
_ZN5boost4json5visitINS0_12_GLOBAL__N_112value_hasherEEEDTclclsr3stdE7declvalIT_EELDnEEEOS4_RKNS0_5valueE	/src/boost/./boost/json/impl/visit.hpp	2	['struct.boost::json::(anonymous namespace)::value_hasher *', 'class.boost::json::value *']	20	0	108	14	15	166	24	244	204
boost::json::object::operator=(std::initializer_list ,boost::json::value_ref>>)	/src/boost/./boost/json/impl/object.ipp	3	['class.boost::json::object *', 'struct.std::__1::pair.13 *', 'size_t ']	8	0	71	6	6	378	0	714	92
boost::json::array::operator=(std::initializer_list )	/src/boost/./boost/json/impl/array.ipp	3	['class.boost::json::array *', 'class.boost::json::value_ref *', 'size_t ']	12	0	76	9	8	368	0	676	54
boost::json::string::replace(unsignedlong,unsignedlong,boost::core::basic_string_view )	/src/boost/./boost/json/impl/string.ipp	5	['class.boost::json::string *', 'size_t ', 'size_t ', 'char *', 'size_t ']	3	0	35	3	2	109	0	163	53
boost::json::operator>>(std::__1::basic_istream >&,boost::json::value&)	/src/boost/./boost/json/impl/value.ipp	2	['class.std::__1::basic_istream *', 'class.boost::json::value *']	12	0	360	57	46	838	0	2209	52
boost::wrapexcept ::clone()const	/src/boost/./boost/throw_exception.hpp	1	['struct.boost::wrapexcept.61 *']	2	0	80	11	11	32	0	64	51
boost::json::make_error_code(boost::json::error)::codes::default_error_condition(int)const	/src/boost/./boost/json/impl/error.ipp	2	['class.boost::system::detail::interop_error_category *', 'int ']	2	0	169	41	42	5	0	48	48
boost::json::value::equal(boost::json::valueconst&)const	/src/boost/./boost/json/impl/value.ipp	2	['class.boost::json::value *', 'class.boost::json::value *']	10	0	220	39	6	292	5	460	47

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

838/1109

Cyclomatic complexity statically reachable by fuzzers

4870 / 6003

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
charconst*boost::json::basic_parser ::parse_value (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	54	4	7.407%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_null (charconst*,std::__1::integral_constant )	65	23	35.38%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_true (charconst*,std::__1::integral_constant )	65	23	35.38%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_false (charconst*,std::__1::integral_constant )	75	27	36.0%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	115	28	24.34%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_escaped (charconst*,unsignedlong,std::__1::integral_constant ,bool,bool)	495	85	17.17%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_array (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	93	32	34.40%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_object (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	145	47	32.41%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_unescaped (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool)	115	27	23.47%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	537	185	34.45%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_value (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	54	4	7.407%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_array (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	93	44	47.31%	['fuzz_parser', 'fuzz_parse']
charconst*boost::json::basic_parser ::parse_object (charconst*,std::__1::integral_constant ,std::__1::integral_constant ,bool,bool)	145	71	48.96%	['fuzz_parser', 'fuzz_parse']
std::__1::pair boost::json::detail::find_in_object >(boost::json::objectconst&,boost::core::basic_string_view )	32	12	37.5%	['fuzz_parser', 'fuzz_parse']
boolboost::json::serializer::write_number (boost::json::detail::stream&)	63	16	25.39%	[]
charconst*boost::json::basic_parser ::parse_document (charconst*,std::__1::integral_constant )	68	27	39.70%	['fuzz_basic_parser']
charconst*boost::json::basic_parser ::parse_number (charconst*,std::__1::integral_constant ,std::__1::integral_constant )	537	279	51.95%	['fuzz_basic_parser']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/boost/./boost/json/detail/sse2.hpp	['fuzz_parser', 'fuzz_parse']	[]
/usr/local/bin/../include/c++/v1/new	[]	[]
/work/stage/include/boost/system/detail/error_category.hpp	[]	[]
/src/boost/./boost/json/impl/value.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/libs/json/fuzzing/fuzz_parse.cpp	['fuzz_parse']	['fuzz_parse']
/work/stage/include/boost/system/detail/generic_category.hpp	[]	[]
/work/stage/include/boost/json/detail/sse2.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/json/impl/null_resource.ipp	['fuzz_parser']	[]
/src/boost/./boost/json/detail/buffer.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/serializer.ipp	['fuzz_parser']	[]
/work/stage/include/boost/json/stream_parser.hpp	['fuzz_parser']	['fuzz_parser']
/src/boost/./boost/json/detail/impl/string_impl.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/object.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/visit.hpp	[]	[]
/src/boost/./boost/json/detail/default_resource.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/work/stage/include/boost/system/detail/error_category_impl.hpp	[]	[]
/src/boost/./boost/json/serializer.hpp	['fuzz_parser']	[]
/src/boost/./boost/system/detail/std_category.hpp	[]	[]
/work/stage/include/boost/system/detail/interop_category.hpp	[]	[]
/work/stage/include/boost/json/detail/handler.hpp	['fuzz_parser']	[]
/src/boost/./boost/json/impl/stream_parser.ipp	['fuzz_parser']	[]
/src/boost/./boost/json/impl/static_resource.ipp	['fuzz_parser']	[]
/src/boost/./boost/json/storage_ptr.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/work/stage/include/boost/json/basic_parser.hpp	['fuzz_parser', 'fuzz_basic_parser']	['fuzz_parser', 'fuzz_basic_parser']
/src/boost/./boost/json/pilfer.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/string.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/generic_category.hpp	[]	[]
/src/boost/./boost/system/detail/std_category_impl.hpp	[]	[]
/src/boost/libs/json/fuzzing/fuzz_basic_parser.cpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/json/detail/impl/shared_resource.ipp	[]	[]
/src/boost/./boost/json/impl/array.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/utf8.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/system_error.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/ryu/detail/d2s_intrinsics.hpp	[]	[]
/src/boost/./boost/json/detail/value.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/error.ipp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/work/stage/include/boost/system/detail/generic_category_message.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/parser.hpp	['fuzz_parse']	[]
/work/stage/include/boost/json/detail/stack.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/exception/exception.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/container/pmr/memory_resource.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/src/boost/./boost/json/impl/object.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/basic_parser.hpp	['fuzz_parser', 'fuzz_parse']	[]
/work/stage/include/boost/json/detail/utf8.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/json/impl/string.hpp	[]	[]
/src/boost/./boost/json/detail/stream.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/impl/handler.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/error_condition.hpp	[]	[]
/src/boost/./boost/system/detail/error_category.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/work/stage/include/boost/system/detail/snprintf.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/kind.ipp	[]	[]
/src/boost/./boost/json/detail/handler.hpp	['fuzz_parse']	[]
/work/stage/include/boost/system/detail/system_category_message.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/ryu/impl/d2s.ipp	[]	[]
/src/boost/./boost/json/detail/impl/format.ipp	[]	[]
/src/boost/./boost/json/detail/digest.hpp	[]	[]
/work/stage/include/boost/system/detail/error_code.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']
/src/boost/./boost/container_hash/detail/hash_tuple_like.hpp	[]	[]
/src/boost/./boost/json/impl/serialize.ipp	['fuzz_parser']	[]
/src/boost/./boost/json/detail/impl/default_resource.ipp	[]	[]
/work/stage/include/boost/core/detail/string_view.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']
/work/stage/include/boost/json/storage_ptr.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']
/src/boost/./boost/container_hash/detail/mulx.hpp	[]	[]
/src/boost/./boost/json/detail/ryu/detail/common.hpp	[]	[]
/work/stage/include/boost/system/detail/system_category_impl.hpp	[]	[]
/work/stage/include/boost/json/value.hpp	['fuzz_parse']	['fuzz_parse']
/src/boost/./boost/json/detail/stack.hpp	['fuzz_parser', 'fuzz_parse']	[]
/work/stage/include/boost/json/parse_options.hpp	['fuzz_parser', 'fuzz_basic_parser']	[]
/src/boost/./boost/json/impl/monotonic_resource.ipp	[]	[]
/work/stage/include/boost/json/detail/stream.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/json/detail/config.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/error_category_impl.hpp	[]	[]
/src/boost/./boost/json/impl/value_ref.ipp	[]	[]
/work/stage/include/boost/json/basic_parser_impl.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/json/detail/impl/stack.ipp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/usr/local/bin/../include/c++/v1/exception	[]	[]
/src/boost/./boost/container_hash/hash.hpp	[]	[]
/src/boost/./boost/json/detail/impl/except.ipp	['fuzz_parser', 'fuzz_parse']	[]
/work/stage/include/boost/json/detail/buffer.hpp	['fuzz_basic_parser']	['fuzz_basic_parser']
/src/boost/./boost/throw_exception.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/system_category.hpp	['fuzz_parser', 'fuzz_parse']	[]
/usr/local/bin/../include/c++/v1/stdexcept	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/interop_category.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/object.hpp	[]	[]
/src/boost/./boost/json/detail/impl/array.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/string_impl.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/assert/source_location.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/pointer.ipp	[]	[]
/src/boost/./boost/json/impl/value_stack.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/array.hpp	[]	[]
/src/boost/./boost/json/detail/array.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/impl/array.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/container_hash/detail/hash_mix.hpp	[]	[]
/src/boost/./boost/json/stream_parser.hpp	[]	[]
/src/boost/./boost/system/detail/append_int.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/detail/ryu/detail/d2s_full_table.hpp	[]	[]
/src/boost/./boost/json/impl/parser.ipp	['fuzz_parse']	[]
/work/stage/include/boost/system/detail/error_condition.hpp	[]	[]
/src/boost/./boost/json/value.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/system/detail/error_code.hpp	['fuzz_parser', 'fuzz_parse', 'fuzz_basic_parser']	[]
/src/boost/./boost/json/detail/ryu/detail/digit_table.hpp	[]	[]
/src/boost/./boost/system/detail/mutex.hpp	[]	[]
/src/boost/./boost/core/detail/string_view.hpp	['fuzz_parse']	[]
/work/stage/include/boost/system/detail/system_category.hpp	[]	[]
/src/boost/./boost/json/basic_parser_impl.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/libs/json/fuzzing/fuzz_parser.cpp	['fuzz_parser']	['fuzz_parser']
/src/boost/./boost/json/impl/object.ipp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/json/string.hpp	['fuzz_parser', 'fuzz_parse']	[]
/src/boost/./boost/container_hash/detail/hash_range.hpp	[]	[]
/src/boost/./boost/json/impl/parse.ipp	['fuzz_parse']	[]

Directories in report

Directory
/src/boost/./boost/exception/
/work/stage/include/boost/system/detail/
/work/stage/include/boost/core/detail/
/src/boost/./boost/json/detail/impl/
/usr/local/bin/../include/c++/v1/
/src/boost/./boost/container/pmr/
/src/boost/./boost/
/src/boost/./boost/core/detail/
/src/boost/./boost/container_hash/detail/
/work/stage/include/boost/json/
/src/boost/./boost/json/detail/ryu/impl/
/src/boost/./boost/assert/
/src/boost/./boost/json/
/src/boost/./boost/container_hash/
/src/boost/./boost/system/
/work/stage/include/boost/json/detail/
/src/boost/./boost/json/detail/ryu/detail/
/src/boost/./boost/system/detail/
/src/boost/./boost/json/detail/
/src/boost/./boost/json/impl/
/src/boost/libs/json/fuzzing/

This section shows a chosen list of functions / methods calls and their relative coverage information. By static analysis of the target project code, all of these function call and their caller information, including the source file or class and line number that initiate the call are captured. Column 1 is the function name of that selected functions or methods. Column 2 of each row indicate if the target function covered by any fuzzer calltree information. Column 3 lists all fuzzers (or no fuzzers at all) that have coered that particular function call dynamically. Column 4 shows list of parent function for the specific function call, while column 5 shows possible blocker functions that make the fuzzers fail to reach the specific functions. Both column 4 and 5 will only show information if none of the fuzzers cover the target function calls.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Function call path	Covered by fuzzer	Possible branch blockers