High level conclusions

Fuzzers reach 82.20% of cyclomatic complexity.

Fuzzers reach 82.60% of all functions.

Fuzzer civetweb_fuzz2 is blocked:

The runtime code coverage of civetweb_fuzz2 covers 13.22% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer civetweb_fuzz1 is blocked:

The runtime code coverage of civetweb_fuzz1 covers 13.22% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

247/299

Cyclomatic complexity statically reachable by fuzzers

2231/2714

Runtime code coverage of functions

82 / 299

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: civetweb_fuzz1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	455	78.3%
gold	[1:9]	105	18.0%
yellow	[10:29]	5	0.86%
greenyellow	[30:49]	6	1.03%
lawngreen	50+	10	1.72%
All colors	581	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
207	207	6 : View List ['__errno_location', 'strerror', 'mg_cry_internal_wrap', 'setgid', 'setuid', 'setgroups']	207	207	set_uid_option	call site: 00291	/src/civetweb/src/civetweb.c:16276
106	106	1 : View List ['initialize_openssl']	106	110	mg_init_library	call site: 00031	/src/civetweb/src/civetweb.c:22437
63	63	1 : View List ['mg_cry_internal_wrap']	63	65	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19753
63	63	1 : View List ['mg_cry_internal_wrap']	63	63	mg_vsnprintf	call site: 00037	/src/civetweb/src/civetweb.c:3124
4	4	2 : View List ['pthread_key_delete', 'pthread_mutexattr_destroy']	6	10	mg_init_library	call site: 00019	/src/civetweb/src/civetweb.c:22382
4	4	2 : View List ['strchr', 'strlen']	6	6	next_option	call site: 00223	/src/civetweb/src/civetweb.c:3930
2	2	1 : View List ['htonl']	4	6	parse_port_string	call site: 00226	/src/civetweb/src/civetweb.c:15516
2	2	1 : View List ['abort']	2	2	civetweb_init	call site: 00345	/src/civetweb/fuzztest/fuzzmain.c:95
2	2	1 : View List ['memchr']	2	2	next_option	call site: 00223	/src/civetweb/src/civetweb.c:3935
0	8	1 : View List ['close_all_listening_sockets']	0	8	set_ports_option	call site: 00276	/src/civetweb/src/civetweb.c:16027
0	2	1 : View List ['mg_free']	0	2	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19906
0	0	None	4192	4222	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19713

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

328

Reachable functions

378

Percentage of reachable functions covered

13.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzztest/fuzzmain.c	5
src/civetweb.c	99
src/md5.inl	4

Fuzzer: civetweb_fuzz3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	166	57.4%
gold	[1:9]	30	10.3%
yellow	[10:29]	10	3.46%
greenyellow	[30:49]	76	26.2%
lawngreen	50+	7	2.42%
All colors	289	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
238	244	5 : View List ['ssl_use_pem_file', 'ssl_error', 'sslize', 'close', 'mg_free']	238	244	mg_connect_client_impl	call site: 00135	/src/civetweb/src/civetweb.c:18153
65	65	2 : View List ['mg_cry_internal_wrap', 'strerror']	311	319	mg_connect_client_impl	call site: 00128	/src/civetweb/src/civetweb.c:18126
63	63	1 : View List ['mg_cry_internal_wrap']	63	63	mg_vsnprintf	call site: 00059	/src/civetweb/src/civetweb.c:3124
14	38	7 : View List ['mg_get_current_time_ns', 'fwrite', '__errno_location', 'send', 'usleep', 'mg_poll', 'ferror']	14	38	push_inner	call site: 00203	/src/civetweb/src/civetweb.c:6105
11	11	1 : View List ['alloc_vprintf2']	11	11	alloc_vprintf	call site: 00182	/src/civetweb/src/civetweb.c:6960
8	8	4 : View List ['close', 'abort', 'strerror', '__errno_location']	8	8	mock_server_init	call site: 00041	/src/civetweb/fuzztest/fuzzmain.c:438
8	8	1 : View List ['mg_strcasecmp']	8	8	get_response	call site: 00258	/src/civetweb/src/civetweb.c:18753
6	6	3 : View List ['htons', 'bind', 'inet_addr']	48	48	mock_server_init	call site: 00009	/src/civetweb/fuzztest/fuzzmain.c:394
6	6	2 : View List ['time', 'sleep']	6	152	mg_write	call site: 00190	/src/civetweb/src/civetweb.c:6801
6	6	3 : View List ['close', 'strerror', '__errno_location']	6	6	connect_socket	call site: 00118	/src/civetweb/src/civetweb.c:9549
4	4	2 : View List ['read', 'fileno']	6	6	pull_inner	call site: 00227	/src/civetweb/src/civetweb.c:6229
2	2	1 : View List ['atoi']	142	142	close_socket_gracefully	call site: 00276	/src/civetweb/src/civetweb.c:17766

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

77

Reachable functions

121

Percentage of reachable functions covered

36.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzztest/fuzzmain.c	5
src/civetweb.c	57

Fuzzer: civetweb_fuzz2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	455	78.3%
gold	[1:9]	105	18.0%
yellow	[10:29]	5	0.86%
greenyellow	[30:49]	6	1.03%
lawngreen	50+	10	1.72%
All colors	581	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
207	207	6 : View List ['__errno_location', 'strerror', 'mg_cry_internal_wrap', 'setgid', 'setuid', 'setgroups']	207	207	set_uid_option	call site: 00291	/src/civetweb/src/civetweb.c:16276
106	106	1 : View List ['initialize_openssl']	106	110	mg_init_library	call site: 00031	/src/civetweb/src/civetweb.c:22437
63	63	1 : View List ['mg_cry_internal_wrap']	63	65	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19753
63	63	1 : View List ['mg_cry_internal_wrap']	63	63	mg_vsnprintf	call site: 00037	/src/civetweb/src/civetweb.c:3124
4	4	2 : View List ['pthread_key_delete', 'pthread_mutexattr_destroy']	6	10	mg_init_library	call site: 00019	/src/civetweb/src/civetweb.c:22382
4	4	2 : View List ['strchr', 'strlen']	6	6	next_option	call site: 00223	/src/civetweb/src/civetweb.c:3930
2	2	1 : View List ['htonl']	4	6	parse_port_string	call site: 00226	/src/civetweb/src/civetweb.c:15516
2	2	1 : View List ['abort']	2	2	civetweb_init	call site: 00345	/src/civetweb/fuzztest/fuzzmain.c:95
2	2	1 : View List ['memchr']	2	2	next_option	call site: 00223	/src/civetweb/src/civetweb.c:3935
0	8	1 : View List ['close_all_listening_sockets']	0	8	set_ports_option	call site: 00276	/src/civetweb/src/civetweb.c:16027
0	2	1 : View List ['mg_free']	0	2	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19906
0	0	None	4192	4222	worker_thread_run	call site: 00000	/src/civetweb/src/civetweb.c:19713

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

328

Reachable functions

378

Percentage of reachable functions covered

13.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzztest/fuzzmain.c	5
src/civetweb.c	99
src/md5.inl	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
mg_handle_form_request	/src/civetweb/src/handle_form.inl	2	['struct.mg_connection *', 'struct.mg_form_data_handler *']	4	0	2393	391	143	63	0	477	173
mg_set_websocket_handler	/src/civetweb/src/civetweb.c	7	['struct.mg_context *', 'char *', 'func_type *', 'func_type *', 'func_type *', 'func_type *', 'char *']	4	0	40	3	2	36	0	148	51
mg_modify_passwords_file	/src/civetweb/src/civetweb.c	4	['char *', 'char *', 'char *', 'char *']	3	0	89	16	7	24	0	105	48

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

259/299

Cyclomatic complexity statically reachable by fuzzers

2501 / 2714

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
mg_start2	389	101	25.96%	['civetweb_fuzz1', 'civetweb_fuzz2']
mg_vsnprintf	33	17	51.51%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
init_ssl_ctx	74	13	17.56%	['civetweb_fuzz1', 'civetweb_fuzz2']
set_ports_option	166	72	43.37%	['civetweb_fuzz1', 'civetweb_fuzz2']
parse_port_string	74	40	54.05%	['civetweb_fuzz1', 'civetweb_fuzz2']
set_uid_option	38	13	34.21%	['civetweb_fuzz1', 'civetweb_fuzz2']
worker_thread_run	104	32	30.76%	['civetweb_fuzz1', 'civetweb_fuzz2']
mg_write	62	20	32.25%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
pull_inner	96	28	29.16%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
push_inner	90	27	30.0%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
close_socket_gracefully	53	19	35.84%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
mg_connect_client_impl	159	52	32.70%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
connect_socket	154	54	35.06%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
get_message	63	27	42.85%	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/civetweb/src/response.inl	[]	[]
/src/civetweb/src/civetweb.c	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
/src/civetweb/src/match.inl	[]	[]
/src/civetweb/fuzztest/fuzzmain.c	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']	['civetweb_fuzz1', 'civetweb_fuzz3', 'civetweb_fuzz2']
/src/civetweb/src/handle_form.inl	[]	[]
/src/civetweb/src/md5.inl	['civetweb_fuzz1', 'civetweb_fuzz2']	[]
/src/civetweb/src/sort.inl	[]	[]

Directories in report

Directory
/src/civetweb/fuzztest/
/src/civetweb/src/

This section shows a chosen list of functions / methods calls and their relative coverage information. By static analysis of the target project code, all of these function call and their caller information, including the source file or class and line number that initiate the call are captured. Column 1 is the function name of that selected functions or methods. Column 2 of each row indicate if the target function covered by any fuzzer calltree information. Column 3 lists all fuzzers (or no fuzzers at all) that have coered that particular function call dynamically. Column 4 shows list of parent function for the specific function call, while column 5 shows possible blocker functions that make the fuzzers fail to reach the specific functions. Both column 4 and 5 will only show information if none of the fuzzers cover the target function calls.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Function call path	Covered by fuzzer	Possible branch blockers
popen	Not in fuzzer provided call tree	['civetweb_fuzz1', 'civetweb_fuzz2']	Parent functions Callpaths do_ssi_exec in /src/civetweb/src/civetweb.c:12443 Path 1 Path 2 Path 3 Path 4	0	Blocker function Arguments type Return type Constants touched worker_thread_run in /src/civetweb/src/civetweb.c:19696 ['struct.mg_connection *'] N/A [] mg_send_mime_file in /src/civetweb/src/civetweb.c:10511 ['struct.mg_connection *', 'char *', 'char *'] N/A [] mg_send_file in /src/civetweb/src/civetweb.c:10502 ['struct.mg_connection *', 'char *'] N/A [] mg_send_file_body in /src/civetweb/src/civetweb.c:10443 ['struct.mg_connection *', 'char *'] int []
execle	Not in fuzzer provided call tree	['civetweb_fuzz1', 'civetweb_fuzz2']	Parent functions Callpaths spawn_process in /src/civetweb/src/civetweb.c:5842 Path 1 Path 2 Path 3 Path 4	0	Blocker function Arguments type Return type Constants touched worker_thread_run in /src/civetweb/src/civetweb.c:19696 ['struct.mg_connection *'] N/A [] mg_send_mime_file in /src/civetweb/src/civetweb.c:10511 ['struct.mg_connection *', 'char *', 'char *'] N/A [] mg_send_file in /src/civetweb/src/civetweb.c:10502 ['struct.mg_connection *', 'char *'] N/A [] mg_send_file_body in /src/civetweb/src/civetweb.c:10443 ['struct.mg_connection *', 'char *'] int []