High level conclusions

Fuzzer glib/fuzzing/fuzz_data_input_stream_read_line_utf8.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_data_input_stream_read_line_utf8.c covers 0.156% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_string.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_string.c covers 0.313% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uri_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uri_parse.c covers 0.239% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz/surface_write_png_fuzzer.c is blocked:

The runtime code coverage of fuzz/surface_write_png_fuzzer.c covers 26.86% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_inet_address_mask_new_from_string.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_inet_address_mask_new_from_string.c covers 0.159% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary_byteswap.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary_byteswap.c covers 0.189% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_canonicalize_filename.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_canonicalize_filename.c covers 0.311% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_data_input_stream_read_upto.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_data_input_stream_read_upto.c covers 0.156% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_data_input_stream_read_line.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_data_input_stream_read_line.c covers 0.156% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_key.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_key.c covers 0.164% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_network_address_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_network_address_parse.c covers 0.185% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary.c covers 0.190% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_inet_socket_address_new_from_string.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_inet_socket_address_new_from_string.c covers 0.155% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz/text_glyphs_fuzzer.c is blocked:

The runtime code coverage of fuzz/text_glyphs_fuzzer.c covers 28.93% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_utf8_validate.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_utf8_validate.c covers 0.336% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_network_address_parse_uri.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_network_address_parse_uri.c covers 0.162% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_time_new_from_iso8601.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_time_new_from_iso8601.c covers 0.311% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uri_escape.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uri_escape.c covers 0.158% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_text.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_text.c covers 0.325% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_paths.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_paths.c covers 0.327% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uri_parse_params.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uri_parse_params.c covers 0.306% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_utf8_normalize.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_utf8_normalize.c covers 0.323% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uuid_string_is_valid.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uuid_string_is_valid.c covers 0.331% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_resolver.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_resolver.c covers 0.200% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_parse.c covers 0.268% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_bookmark.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_bookmark.c covers 0.246% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_inet_address_new_from_string.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_inet_address_new_from_string.c covers 0.185% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_dbus_message.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_dbus_message.c covers 0.210% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 8.034% of cyclomatic complexity.

Fuzzers reach 6.743% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1637 / 24275

Cyclomatic complexity statically reachable by fuzzers

13964 / 173804

Runtime code coverage of functions

1340 / 24275

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: glib/fuzzing/fuzz_dbus_message.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3304	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.09%
greenyellow	[30:49]	3	0.09%
lawngreen	50+	1	0.03%
All colors	3311	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2480	293	LLVMFuzzerTestOneInput	call site: 00293	parse_value_from_blob
350	2774	LLVMFuzzerTestOneInput	call site: 02774	append_value_to_blob
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
184	3126	LLVMFuzzerTestOneInput	call site: 03126	g_object_notify_queue_freeze
41	251	LLVMFuzzerTestOneInput	call site: 00251	g_set_error

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

946

Reachable functions

948

Percentage of reachable functions covered

0.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_dbus_message.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	11
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	29
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gdbusmessage.c	36
glib/gobject/gobject.c	34
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/gio/gdbusprivate.c	1
glib/glib/gvarianttype.c	32
glib/glib/gvariant.c	74
glib/glib/gvariant-core.c	25
glib/glib/gvarianttypeinfo.c	20
glib/glib/gbytes.c	8
glib/glib/gvariant-serialiser.c	10
glib/glib/ggettext.c	2
glib/glib/gwin32.c	1
glib/glib/gmem.h	1
glib/glib/garray.c	7
glib/glib/gbitlock.c	8
glib/glib/gvarianttype-private.h	1
glib/glib/guniprop.c	1
glib/.gitlab-ci/coverity-model.c	1
glib/gio/gdbusutils.c	6
glib/gio/gunixfdlist.c	1
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5

Fuzzer: glib/fuzzing/fuzz_inet_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1150	99.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.34%
lawngreen	50+	2	0.17%
All colors	1156	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
888	254	LLVMFuzzerTestOneInput	call site: 00254	g_inet_address_new_from_bytes
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
7	1144	LLVMFuzzerTestOneInput	call site: 01144
3	1152	LLVMFuzzerTestOneInput	call site: 01152	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

539

Reachable functions

540

Percentage of reachable functions covered

0.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	10
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	23
glib/glib/gslice.c	2
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddress.c	3
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	35
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1

Fuzzer: cairo/test/svg/fuzzer/svg-render-fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1011	53.3%
gold	[1:9]	84	4.43%
yellow	[10:29]	33	1.74%
greenyellow	[30:49]	15	0.79%
lawngreen	50+	753	39.7%
All colors	1896	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
182	1584	cairo_font_options_equal	call site: 01584	_cairo_surface_show_text_glyphs
58	702	_cairo_malloc_ab	call site: 00702	bbtree_add
53	1451	_cairo_surface_stroke	call site: 01451	_cairo_surface_wrapper_fill_stroke
51	922	_cairo_path_fixed_init	call site: 00922	_cairo_path_fixed_add_box
34	243	parse_svg	call site: 00243	g_printerr
33	1306	_linear_pattern_is_degenerate	call site: 01306	_cairo_gradient_pattern_box_to_parameter
26	1191	_cairo_boxes_intersect_with_box	call site: 01191	intersect
26	1245	_cairo_clip_intersect_path	call site: 01245	_cairo_clip_intersect_clip_path_transformed
24	301	_cairo_render_svg_glyph	call site: 00301	print_element
24	1558	cairo_font_options_merge	call site: 01558	cairo_scaled_font_create
19	1385	_gradient_is_opaque	call site: 01385	_cairo_surface_wrapper_mask
19	1420	_cairo_surface_mask	call site: 01420	_cairo_surface_wrapper_stroke

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

588

Reachable functions

953

Percentage of reachable functions covered

38.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
cairo/test/svg/fuzzer/svg-render-fuzzer.c	1
cairo/util/cairo-missing/strndup.c	1
cairocairo-svg-glyph-render.c	35
cairocairo-pattern.c	22
cairocairo-freed-pool-private.h	4
cairocairo-atomic-private.h	1
cairocairo-freed-pool.c	2
cairocairo-array.c	13
cairocairo-matrix.c	19
cairocairo-list-inline.h	10
cairocairo-error.c	1
cairocairo-hash.c	9
cairocairo-malloc-private.h	4
cairocairo-ctype-inline.h	1
cairocairo-misc.c	3
cairocairo-cache.c	8
glib/gio/gio-tool.c	1
glib/glib/gstrfuncs.c	1
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gmessages.c	2
cairocairo-recording-surface.c	17
cairocairo-recording-surface-inline.h	1
cairocairo-analysis-surface.c	6
cairocairo-surface.c	30
cairocairo-device.c	5
cairocairo-region.c	4
cairocairo-surface-inline.h	2
cairocairo-damage.c	1
cairocairo-font-options.c	6
cairocairoint.h	5
cairocairo-surface-wrapper.c	17
cairocairo-rectangle.c	5
cairocairo-clip.c	16
cairocairo-clip-inline.h	2
cairocairo-fixed-private.h	10
cairocairo-analysis-surface-private.h	1
cairocairo-path-fixed.c	22
cairocairo-clip-boxes.c	6
cairocairo-box-inline.h	4
cairocairo-boxes.c	9
cairocairo-wideint.c	2
cairocairo-path-bounds.c	4
cairocairo-path-fixed-private.h	2
cairocairo-path-fill.c	8
cairocairo-bentley-ottmann-rectangular.c	6
cairocairo-traps.c	2
cairocairo-polygon.c	5
cairocairo-bentley-ottmann-rectilinear.c	2
cairocairo-boxes-intersect.c	3
cairocairo-surface-snapshot-inline.h	2
cairocairo-image-surface.c	2
cairocairo-raster-source-pattern.c	2
cairocairo-surface-wrapper-private.h	1
glib/glib/tests/messages-low-memory.c	1
cairocairo-scaled-font.c	20
cairocairo-image-compositor.c	1
cairocairo-color.c	1
cairocairo-font-face.c	2
cairocairo-path.c	1

Fuzzer: glib/fuzzing/fuzz_bookmark.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	752	99.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	4	0.52%
All colors	757	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
481	272	LLVMFuzzerTestOneInput	call site: 00272	g_bookmark_file_parse
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
20	251	LLVMFuzzerTestOneInput	call site: 00251	g_hash_table_new_full
2	754	LLVMFuzzerTestOneInput	call site: 00754	g_bookmark_file_clear

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

404

Reachable functions

405

Percentage of reachable functions covered

0.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_bookmark.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	15
glib/glib/gslist.c	10
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	8
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gbookmarkfile.c	6
glib/glib/glist.c	3
glib/glib/gmarkup.c	35
glib/glib/gstring.c	2
glib/glib/gutilsprivate.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_date_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1171	99.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.25%
lawngreen	50+	3	0.25%
All colors	1177	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
916	256	LLVMFuzzerTestOneInput	call site: 00256	g_date_prepare_to_parse
252	3	LLVMFuzzerTestOneInput	call site: 00003	g_logv
2	1174	LLVMFuzzerTestOneInput	call site: 01174
1	1	LLVMFuzzerTestOneInput	call site: 00001

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

371

Reachable functions

372

Percentage of reachable functions covered

0.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_parse.c	1
glib/glib/gdate.c	25
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gthread.c	9
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	6
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	18
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	21
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/garray.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gconvert.c	13
glib/glib/gcharset.c	5
glib/glib/gmem.h	1
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/win_iconv.c	13
glib/glib/gwin32.c	1
glib/glib/guniprop.c	2
glib/glib/gstring.c	6
glib/glib/gunidecomp.c	7

Fuzzer: glib/fuzzing/fuzz_resolver.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1229	99.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1230	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1229	0	EP	call site: 00000	test_for_rrtype

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

497

Reachable functions

498

Percentage of reachable functions covered

0.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_resolver.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	10
glib/glib/gmessages.h	4
glib/glib/gstrfuncs.c	7
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	12
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/gthreadedresolver.c	7
glib/glib/gvariant.c	40
glib/glib/gvarianttype.c	26
glib/glib/gvariant-core.c	9
glib/glib/gvarianttypeinfo.c	17
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1
glib/glib/glib-private.h	1
glib/glib/garray.c	10
glib/glib/gbytes.c	6
glib/glib/gvariant-serialiser.c	4
glib/glib/gmem.h	1
glib/glib/glist.c	4

Fuzzer: glib/fuzzing/fuzz_uuid_string_is_valid.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	259	98.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.38%
lawngreen	50+	3	1.14%
All colors	263	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
10	251	LLVMFuzzerTestOneInput	call site: 00251	g_uuid_string_is_valid

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

301

Reachable functions

302

Percentage of reachable functions covered

0.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uuid_string_is_valid.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/guuid.c	2

Fuzzer: glib/fuzzing/fuzz_utf8_normalize.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	292	96.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	1.32%
greenyellow	[30:49]	3	0.99%
lawngreen	50+	4	1.32%
All colors	303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
42	253	LLVMFuzzerTestOneInput	call site: 00253	g_ucs4_to_utf8
1	299	LLVMFuzzerTestOneInput	call site: 00299

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

308

Reachable functions

309

Percentage of reachable functions covered

0.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_normalize.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	8
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gunidecomp.c	7

Fuzzer: glib/fuzzing/fuzz_uri_parse_params.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	505	98.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.39%
greenyellow	[30:49]	3	0.58%
lawngreen	50+	2	0.39%
All colors	512	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
255	251	LLVMFuzzerTestOneInput	call site: 00251	g_uri_params_iter_next
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
1	508	LLVMFuzzerTestOneInput	call site: 00508	g_error_free

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

325

Reachable functions

326

Percentage of reachable functions covered

0.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse_params.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	12
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	6
glib/glib/gstring.c	5
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1

Fuzzer: glib/fuzzing/fuzz_paths.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	290	95.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	1.65%
greenyellow	[30:49]	6	1.98%
lawngreen	50+	2	0.66%
All colors	303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
19	277	LLVMFuzzerTestOneInput	call site: 00277
14	262	LLVMFuzzerTestOneInput	call site: 00262	g_malloc
4	254	LLVMFuzzerTestOneInput	call site: 00254
2	251	LLVMFuzzerTestOneInput	call site: 00251
2	300	LLVMFuzzerTestOneInput	call site: 00300

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

304

Reachable functions

305

Percentage of reachable functions covered

0.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_paths.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	3

Fuzzer: glib/fuzzing/fuzz_variant_text.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1652	99.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.18%
lawngreen	50+	2	0.12%
All colors	1657	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1354	1	LLVMFuzzerTestOneInput	call site: 00001	g_variant_parse
298	1356	LLVMFuzzerTestOneInput	call site: 01356	g_variant_print_string

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

612

Reachable functions

614

Percentage of reachable functions covered

0.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_text.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	10
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	13
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant-parser.c	37
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gvariant.c	46
glib/glib/gvarianttype.c	29
glib/glib/gvariant-core.c	20
glib/glib/gvarianttypeinfo.c	18
glib/glib/glib-private.h	1
glib/glib/garray.c	7
glib/glib/gbytes.c	7
glib/glib/gvariant-serialiser.c	8
glib/glib/gbitlock.c	6
glib/glib/gmem.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_uri_escape.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	252	99.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.39%
All colors	253	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
252	0	EP	call site: 00000	test_bytes

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

630

Reachable functions

631

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_escape.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: fuzz/raster_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	51.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	1.47%
greenyellow	[30:49]	3	1.47%
lawngreen	50+	93	45.8%
All colors	203	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	60	cairo_pdf_surface_set_metadata	call site: 00060	iso8601_to_pdf_date_string
17	175	cairo_surface_destroy	call site: 00175	cairo_device_destroy
7	29	cairo_image_surface_get_height	call site: 00029	cairo_set_source
6	106	_cairo_pdf_interchange_set_metadata	call site: 00106
5	53	_extract_pdf_surface	call site: 00053	cairo_pdf_surface_set_metadata
5	128	cairo_list_is_empty	call site: 00128	_cairo_surface_detach_snapshot
4	113	cairo_pdf_surface_set_metadata	call site: 00113	cairo_surface_destroy
4	162	cairo_region_destroy	call site: 00162	_cairo_region_fini
3	8	fuzzer_get_tmpfile	call site: 00008
3	12	fuzzer_get_tmpfile	call site: 00012
3	22	fuzzer_release_tmpfile	call site: 00022	cairo_create
3	49	_cairo_paginated_surface_get_target	call site: 00049	_cairo_surface_set_error

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

121

Reachable functions

177

Percentage of reachable functions covered

31.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/raster_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairocairo-surface.c	12
cairocairo-image-surface.c	2
cairocairo-image-surface-inline.h	1
cairocairo-raster-source-pattern.c	1
cairocairo-pdf-surface.c	5
cairocairo-error.c	1
cairocairo-paginated-surface.c	2
cairocairo-pdf-interchange.c	2
cairocairo-ctype-inline.h	1
cairocairo-unicode.c	4
cairocairo-malloc-private.h	1
cairocairo-list-inline.h	7
cairocairo-array.c	5
cairocairo-surface-inline.h	1
cairocairo-damage.c	1
cairocairo-region.c	2
cairocairo-device.c	4
cairocairo-font-options.c	1

Fuzzer: glib/fuzzing/fuzz_date_time_new_from_iso8601.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2229	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.17%
lawngreen	50+	2	0.08%
All colors	2235	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1574	254	LLVMFuzzerTestOneInput	call site: 00254	parse_iso8601_time
402	1830	LLVMFuzzerTestOneInput	call site: 01830	g_date_time_format_utf8
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
1	2233	LLVMFuzzerTestOneInput	call site: 02233	g_clear_pointer

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

640

Reachable functions

642

Percentage of reachable functions covered

0.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_time_new_from_iso8601.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gthread.c	9
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	13
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	2
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	16
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	10
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	8
glib/glib/tests/messages-low-memory.c	1
glib/glib/gdatetime.c	38
glib/glib/gtimezone.c	47
glib/glib/gfileutils.c	17
glib/glib/gconvert.c	16
glib/glib/gmem.h	1
glib/glib/gcharset.c	7
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/garray.c	14
glib/glib/gutilsprivate.h	2
glib/glib/win_iconv.c	13
glib/glib/gwin32.c	2
glib/glib/gstring.c	9
glib/glib/gstdio.c	15
glib/glib/gstdio-private.c	2
glib/glib/ggettext.c	2
glib/.gitlab-ci/coverity-model.c	1
glib/glib/guniprop.c	11
glib/glib/gdate.c	17
glib/glib/gmappedfile.c	7
glib/glib/gbytes.c	3
glib/glib/gdatetime-private.c	5
glib/glib/gunidecomp.c	4

Fuzzer: cairo/meson-cc-tests/fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
cairo/meson-cc-tests/fuzzer.c	1

Fuzzer: glib/fuzzing/fuzz_network_address_parse_uri.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1529	99.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.26%
lawngreen	50+	2	0.13%
All colors	1535	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1270	254	LLVMFuzzerTestOneInput	call site: 00254	g_object_new
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
5	1526	LLVMFuzzerTestOneInput	call site: 01526
2	1532	LLVMFuzzerTestOneInput	call site: 01532	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

614

Reachable functions

615

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse_uri.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	10
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	10
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	17
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	23
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	1
glib/glib/guri.c	13
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gunidecomp.c	8
glib/gobject/gobject.c	20
glib/gobject/gtype.c	35
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_utf8_validate.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	301	99.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	0.98%
All colors	304	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
52	251	LLVMFuzzerTestOneInput	call site: 00251	utf8_verify

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

296

Reachable functions

297

Percentage of reachable functions covered

0.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_validate.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: fuzz/text_glyphs_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	225	62.8%
gold	[1:9]	32	8.93%
yellow	[10:29]	3	0.83%
greenyellow	[30:49]	8	2.23%
lawngreen	50+	90	25.1%
All colors	358	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	310	_cairo_array_index_const	call site: 00310	cairo_scaled_font_text_to_glyphs_internal_uncached
33	57	cairo_scaled_font_text_to_glyphs	call site: 00057	cairo_scaled_font_text_to_glyphs_internal_cached
22	118	_cairo_hash_table_create	call site: 00118	_cairo_cache_insert
19	169	cairo_list_add_tail	call site: 00169	_cairo_scaled_font_free_last_glyph
17	243	cairo_surface_destroy	call site: 00243	cairo_device_destroy
12	98	cairo_list_is_empty	call site: 00098	_cairo_cache_init
12	295	_cairo_array_append_multiple	call site: 00295	_cairo_scaled_font_thaw_cache
8	141	_cairo_hash_table_remove	call site: 00141	_cairo_hash_table_manage
5	92	_cairo_hash_table_lookup	call site: 00092	_cairo_scaled_font_allocate_glyph
5	158	_cairo_hash_table_insert	call site: 00158	cairo_list_add_tail
5	352	cairo_text_extents	call site: 00352	cairo_show_text_glyphs
4	230	cairo_region_destroy	call site: 00230	_cairo_region_fini

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

167

Reachable functions

235

Percentage of reachable functions covered

28.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/text_glyphs_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairocairo-surface.c	11
cairocairo.c	3
cairocairo-error.c	1
cairocairo-scaled-font.c	12
cairocairo-unicode.c	4
cairocairo-malloc-private.h	3
cairocairo-misc.c	5
cairocairo-hash.c	8
cairocairo-list-inline.h	10
cairocairo-cache.c	7
cairocairo-image-compositor.c	1
cairocairo-array.c	13
cairocairo-surface-inline.h	1
cairocairo-damage.c	1
cairocairo-region.c	2
cairocairo-device.c	4
cairocairo-font-options.c	1
cairocairo-path-fixed.c	3
cairocairo-color.c	1

Fuzzer: glib/fuzzing/fuzz_inet_socket_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1446	99.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	0.34%
lawngreen	50+	2	0.13%
All colors	1453	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1186	254	LLVMFuzzerTestOneInput	call site: 00254	g_socket_address_new_from_native
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
5	1442	LLVMFuzzerTestOneInput	call site: 01442
3	1449	LLVMFuzzerTestOneInput	call site: 01449	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

641

Reachable functions

642

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_socket_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	26
glib/glib/gslice.c	2
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetsocketaddress.c	2
glib/gio/gsocketaddress.c	1
glib/gio/ginetaddress.c	3
glib/gobject/gobject.c	34
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gbitlock.c	8
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5
glib/gio/gunixsocketaddress.c	3
glib/glib/garray.c	7
glib/gio/gnativesocketaddress.c	1
glib/gio/gnetworking.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_variant_binary.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1126	99.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	0.44%
lawngreen	50+	3	0.26%
All colors	1134	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
667	463	LLVMFuzzerTestOneInput	call site: 00463	g_variant_deep_copy
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
204	251	LLVMFuzzerTestOneInput	call site: 00251	g_variant_new_take_bytes
6	456	LLVMFuzzerTestOneInput	call site: 00456

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

525

Reachable functions

526

Percentage of reachable functions covered

0.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	12
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	27
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	23
glib/glib/gvarianttypeinfo.c	18
glib/glib/glib-private.h	1
glib/glib/gvariant-serialiser.c	9
glib/glib/gmem.h	1
glib/glib/gbitlock.c	6
glib/glib/garray.c	7
glib/glib/gutilsprivate.h	1
glib/glib/gstring.c	3

Fuzzer: glib/fuzzing/fuzz_network_address_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1194	99.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.33%
lawngreen	50+	2	0.16%
All colors	1200	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
934	254	LLVMFuzzerTestOneInput	call site: 00254	g_network_address_new
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
5	1190	LLVMFuzzerTestOneInput	call site: 01190
3	1196	LLVMFuzzerTestOneInput	call site: 01196	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

537

Reachable functions

538

Percentage of reachable functions covered

0.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	10
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	23
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	2
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	35
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_key.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	98.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	1.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.39%
All colors	254	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

608

Reachable functions

609

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_key.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_data_input_stream_read_line.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1489	99.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	6	0.40%
lawngreen	50+	2	0.13%
All colors	1498	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
899	251	LLVMFuzzerTestOneInput	call site: 00251	g_memory_input_stream_new
335	1155	LLVMFuzzerTestOneInput	call site: 01155	g_buffered_input_stream_set_buffer_size
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
3	1151	LLVMFuzzerTestOneInput	call site: 01151	g_object_new
3	1494	LLVMFuzzerTestOneInput	call site: 01494	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

639

Reachable functions

640

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_data_input_stream_read_line.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	26
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gmemoryinputstream.c	4
glib/gobject/gobject.c	36
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gbytes.c	4
glib/gio/gdatainputstream.c	3
glib/gio/gbufferedinputstream.c	5
glib/glib/gbitlock.c	8
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5
glib/gio/ginputstream.c	3
glib/gio/gcancellable.c	2

Fuzzer: glib/fuzzing/fuzz_data_input_stream_read_upto.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1504	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.13%
lawngreen	50+	1	0.06%
All colors	1507	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1255	251	LLVMFuzzerTestOneInput	call site: 00251	g_memory_input_stream_new_from_data
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

639

Reachable functions

640

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_data_input_stream_read_upto.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	26
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gmemoryinputstream.c	4
glib/gobject/gobject.c	36
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gbytes.c	4
glib/gio/gdatainputstream.c	3
glib/gio/gbufferedinputstream.c	5
glib/glib/gbitlock.c	8
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5
glib/gio/ginputstream.c	3
glib/gio/gcancellable.c	2

Fuzzer: glib/fuzzing/fuzz_canonicalize_filename.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	509	99.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.58%
lawngreen	50+	2	0.38%
All colors	514	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
257	254	LLVMFuzzerTestOneInput	call site: 00254	g_build_filename
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

320

Reachable functions

321

Percentage of reachable functions covered

0.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_canonicalize_filename.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	18
glib/glib/gslice.c	2
glib/glib/gmem.c	4
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	7
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1

Fuzzer: glib/fuzzing/fuzz_variant_binary_byteswap.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1159	99.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.34%
lawngreen	50+	3	0.25%
All colors	1166	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
706	456	LLVMFuzzerTestOneInput	call site: 00456	g_variant_deep_copy
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
204	251	LLVMFuzzerTestOneInput	call site: 00251	g_variant_new_take_bytes

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

527

Reachable functions

528

Percentage of reachable functions covered

0.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary_byteswap.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	12
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	28
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	24
glib/glib/gvarianttypeinfo.c	18
glib/glib/glib-private.h	1
glib/glib/gvariant-serialiser.c	10
glib/glib/gmem.h	1
glib/glib/gbitlock.c	6
glib/glib/garray.c	7
glib/glib/gutilsprivate.h	1
glib/glib/gstring.c	3

Fuzzer: glib/fuzzing/fuzz_inet_address_mask_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1429	99.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.27%
lawngreen	50+	2	0.13%
All colors	1435	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1161	254	LLVMFuzzerTestOneInput	call site: 00254	g_inet_address_mask_new
252	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
13	1417	LLVMFuzzerTestOneInput	call site: 01417	g_strdup_printf
3	1431	LLVMFuzzerTestOneInput	call site: 01431	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

626

Reachable functions

627

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_mask_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	26
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddressmask.c	3
glib/gio/ginetaddress.c	4
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	34
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/ginitable.c	3
glib/glib/gbitlock.c	8
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5

Fuzzer: fuzz/surface_write_png_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	46	38.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	3.30%
greenyellow	[30:49]	9	7.43%
lawngreen	50+	62	51.2%
All colors	121	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	90	cairo_surface_destroy	call site: 00090	cairo_device_destroy
5	39	cairo_list_is_empty	call site: 00039	_cairo_surface_detach_snapshot
4	77	cairo_region_destroy	call site: 00077	_cairo_region_fini
3	8	fuzzer_get_tmpfile	call site: 00008
3	12	fuzzer_get_tmpfile	call site: 00012
3	73	_cairo_surface_finish	call site: 00073	_cairo_damage_destroy
2	2	fuzzer_get_tmpfile	call site: 00002
2	5	fuzzer_get_tmpfile	call site: 00005
2	50	_cairo_surface_detach_snapshot	call site: 00050	_cairo_surface_detach_snapshot
2	86	_cairo_region_fini	call site: 00086
1	20	fuzzer_release_tmpfile	call site: 00020
1	24	cairo_image_surface_get_format	call site: 00024

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

98

Reachable functions

134

Percentage of reachable functions covered

26.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/surface_write_png_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairocairo-surface.c	11
cairocairo-image-surface.c	1
cairocairo-image-surface-inline.h	1
cairocairo-list-inline.h	7
cairocairo-array.c	5
cairocairo-surface-inline.h	1
cairocairo-error.c	1
cairocairo-damage.c	1
cairocairo-region.c	2
cairocairo-device.c	4
cairocairo-font-options.c	1

Fuzzer: glib/fuzzing/fuzz_uri_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	963	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.10%
All colors	964	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
963	0	EP	call site: 00000	test_with_flags

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

417

Reachable functions

418

Percentage of reachable functions covered

0.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	9
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	18
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	18
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	23
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	9
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/glib/gunidecomp.c	8
glib/glib/garcbox.c	1

Fuzzer: fuzz/pdf_surface_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	91	46.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	1.01%
greenyellow	[30:49]	8	4.06%
lawngreen	50+	96	48.7%
All colors	197	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	45	cairo_pdf_surface_set_metadata	call site: 00045	iso8601_to_pdf_date_string
17	169	cairo_surface_destroy	call site: 00169	cairo_device_destroy
6	91	_cairo_pdf_interchange_set_metadata	call site: 00091
5	122	cairo_list_is_empty	call site: 00122	_cairo_surface_detach_snapshot
4	156	cairo_region_destroy	call site: 00156	_cairo_region_fini
3	8	fuzzer_get_tmpfile	call site: 00008
3	12	fuzzer_get_tmpfile	call site: 00012
3	38	_cairo_paginated_surface_get_target	call site: 00038	_cairo_surface_set_error
3	108	cairo_tag_end	call site: 00108	cairo_surface_destroy
3	152	_cairo_surface_finish	call site: 00152	_cairo_damage_destroy
2	2	fuzzer_get_tmpfile	call site: 00002
2	5	fuzzer_get_tmpfile	call site: 00005

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

105

Reachable functions

155

Percentage of reachable functions covered

32.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/pdf_surface_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairocairo-surface.c	11
cairocairo-pdf-surface.c	4
cairocairo-error.c	1
cairocairo-paginated-surface.c	2
cairocairo-pdf-interchange.c	2
cairocairo-ctype-inline.h	1
cairocairo-unicode.c	4
cairocairo-malloc-private.h	1
cairocairo.c	3
cairocairo-list-inline.h	7
cairocairo-array.c	5
cairocairo-surface-inline.h	1
cairocairo-damage.c	1
cairocairo-region.c	2
cairocairo-device.c	4
cairocairo-font-options.c	1

Fuzzer: glib/fuzzing/fuzz_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	361	98.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.82%
lawngreen	50+	1	0.27%
All colors	365	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
250	0	EP	call site: 00000	g_logv
58	254	LLVMFuzzerTestOneInput	call site: 00254	g_ptr_array_new
51	313	LLVMFuzzerTestOneInput	call site: 00313	g_string_replace
2	251	LLVMFuzzerTestOneInput	call site: 00251

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

318

Reachable functions

319

Percentage of reachable functions covered

0.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	8
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	6
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	3
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/garray.c	8
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/gstring.c	5

Fuzzer: glib/fuzzing/fuzz_data_input_stream_read_line_utf8.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1494	99.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	6	0.39%
lawngreen	50+	2	0.13%
All colors	1503	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
899	251	LLVMFuzzerTestOneInput	call site: 00251	g_memory_input_stream_new
340	1155	LLVMFuzzerTestOneInput	call site: 01155	g_data_input_stream_read_line
249	1	LLVMFuzzerTestOneInput	call site: 00001	g_logv
3	1151	LLVMFuzzerTestOneInput	call site: 01151	g_object_new
3	1499	LLVMFuzzerTestOneInput	call site: 01499	g_clear_object

Runtime coverage analysis

Covered functions

1972

Functions that are reachable but not covered

640

Reachable functions

641

Percentage of reachable functions covered

0.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_data_input_stream_read_line_utf8.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	16
glib/glib/gthread.c	11
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	26
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gmemoryinputstream.c	4
glib/gobject/gobject.c	36
glib/gobject/gtype.c	36
glib/gobject/gtypeplugin.c	3
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	7
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gbytes.c	4
glib/gio/gdatainputstream.c	4
glib/gio/gbufferedinputstream.c	5
glib/glib/gbitlock.c	8
glib/gobject/tests/reference.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	5
glib/gio/ginputstream.c	3
glib/gio/gcancellable.c	2