High level conclusions

Fuzzers reach 98.34% of cyclomatic complexity.

Fuzzers reach 98.70% of all functions.

Fuzzers reach 66.45% code coverage.

Fuzzer fuzz_cups is blocked:

The runtime code coverage of fuzz_cups covers 22.68% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_raster is blocked:

The runtime code coverage of fuzz_raster covers 18.55% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

153 / 155

Cyclomatic complexity statically reachable by fuzzers

1486 / 1511

Runtime code coverage of functions

103 / 155

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_array

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	25.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	74.1%
All colors	58	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['realloc']	2	19	cups_array_add	call site: 00019	/src/cups/cups/array.c:1030
0	0	None	2	2	cupsArrayDup	call site: 00043	/src/cups/cups/array.c:296
0	0	None	0	40	cupsArrayAdd	call site: 00018	/src/cups/cups/array.c:78
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:363
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:367
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:371
0	0	None	0	17	cupsArrayRemove	call site: 00045	/src/cups/cups/array.c:897
0	0	None	0	17	cupsArrayRemove	call site: 00045	/src/cups/cups/array.c:901
0	0	None	0	17	cups_array_add	call site: 00020	/src/cups/cups/array.c:1047
0	0	None	0	17	cups_array_add	call site: 00020	/src/cups/cups/array.c:1059
0	0	None	0	6	cupsArrayGetFirst	call site: 00025	/src/cups/cups/array.c:507
0	0	None	0	6	cupsArrayGetLast	call site: 00032	/src/cups/cups/array.c:562

Runtime coverage analysis

Covered functions

24

Functions that are reachable but not covered

9

Reachable functions

33

Percentage of reachable functions covered

72.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_array.c	1
/src/cups/ossfuzz/fuzz_helpers.cpp	1
/src/cups/cups/array.c	22

Fuzzer: fuzz_raster

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	63.5%
gold	[1:9]	29	14.2%
yellow	[10:29]	1	0.49%
greenyellow	[30:49]	4	1.97%
lawngreen	50+	40	19.7%
All colors	203	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	12	1 : View List ['validate_end']	12	12	cupsCopyString	call site: 00046	/src/cups/cups/string.c:115
4	357	3 : View List ['__errno_location', 'strerror', '_cupsRasterAddError']	4	357	cups_raster_update	call site: 00195	/src/cups/cups/raster-stream.c:1874
4	4	1 : View List ['htonl']	8	718	_cupsRasterNew	call site: 00149	/src/cups/cups/raster-stream.c:794
2	2	1 : View List ['getuid']	4	4	cups_globals_alloc	call site: 00138	/src/cups/cups/globals.c:379
2	2	1 : View List ['realloc']	2	2	_cupsRasterAddError	call site: 00151	/src/cups/cups/raster-error.c:66
2	2	1 : View List ['realloc']	2	2	cups_raster_read	call site: 00180	/src/cups/cups/raster-stream.c:1617
0	0	None	36	56	cups_globals_alloc	call site: 00121	/src/cups/cups/globals.c:179
0	0	1 : View List ['free']	6	359	cups_raster_update	call site: 00194	/src/cups/cups/raster-stream.c:1871
0	0	None	6	6	cups_globals_alloc	call site: 00133	/src/cups/cups/globals.c:341
0	0	None	4	357	_cupsRasterNew	call site: 00146	/src/cups/cups/raster-stream.c:783
0	0	None	2	2	cups_globals_alloc	call site: 00136	/src/cups/cups/globals.c:369
0	0	None	2	2	cups_globals_alloc	call site: 00137	/src/cups/cups/globals.c:374

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

79

Reachable functions

97

Percentage of reachable functions covered

18.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_raster.c	2
/src/cups/cups/raster-stubs.c	5
/src/cups/cups/raster-stream.c	6
/src/cups/cups/raster-error.c	2
/src/cups/cups/globals.c	4
/src/cups/cups/string.c	4
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	4
/src/cups/cups/http.c	9
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	1
/src/cups/cups/http-addrlist.c	1
/usr/include/openssl/x509.h	1
/src/cups/cups/file.c	4
/src/cups/cups/options.c	1

Fuzzer: fuzz_cups

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	41.6%
gold	[1:9]	22	7.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	50.6%
All colors	288	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['getuid']	4	4	cups_globals_alloc	call site: 00132	/src/cups/cups/globals.c:379
0	0	None	36	56	cups_globals_alloc	call site: 00115	/src/cups/cups/globals.c:179
0	0	None	10	36	_cupsStrScand	call site: 00159	/src/cups/cups/string.c:855
0	0	None	6	6	cups_globals_alloc	call site: 00127	/src/cups/cups/globals.c:341
0	0	None	6	6	_cupsStrScand	call site: 00161	/src/cups/cups/string.c:892
0	0	None	2	2	cups_globals_alloc	call site: 00130	/src/cups/cups/globals.c:369
0	0	None	2	2	cups_globals_alloc	call site: 00131	/src/cups/cups/globals.c:374
0	0	None	0	353	_cupsRasterExecPS	call site: 00003	/src/cups/cups/raster-interpret.c:523
0	0	None	0	353	_cupsRasterExecPS	call site: 00142	/src/cups/cups/raster-interpret.c:529
0	0	None	0	5	copy_stack	call site: 00189	/src/cups/cups/raster-interpret.c:733
0	0	None	0	0	_cupsRasterAddError	call site: 00140	/src/cups/cups/raster-error.c:44
0	0	None	0	0	_cupsRasterAddError	call site: 00140	/src/cups/cups/raster-error.c:51

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

75

Reachable functions

97

Percentage of reachable functions covered

22.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_cups.c	1
/src/cups/cups/raster-interpret.c	13
/src/cups/cups/raster-error.c	1
/src/cups/cups/globals.c	4
/src/cups/cups/string.c	5
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	4
/src/cups/cups/http.c	9
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	1
/src/cups/cups/http-addrlist.c	1
/usr/include/openssl/x509.h	1
/src/cups/cups/file.c	4
/src/cups/cups/options.c	1
/src/cups/cups/./string-private.h	1

Fuzzer: fuzz_ipp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	381	60.0%
gold	[1:9]	95	14.9%
yellow	[10:29]	17	2.68%
greenyellow	[30:49]	2	0.31%
lawngreen	50+	139	21.9%
All colors	634	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
300	483	10 : View List ['strchr', 'cupsArrayAdd', 'cupsConcatString', 'strrchr', 'cupsCopyString', 'cups_unquote', 'cupsFileGets', 'cupsFileClose', 'strncmp', 'cups_read_strings']	300	483	_cupsMessageLoad	call site: 00266	/src/cups/cups/language.c:698
203	260	2 : View List ['cupsFileClose', 'cups_read_client_conf']	203	1051	_cupsSetDefaults	call site: 00498	/src/cups/cups/usersys.c:1141
184	184	1 : View List ['httpClose']	184	184	cupsSetServer	call site: 00544	/src/cups/cups/usersys.c:571
30	63	7 : View List ['inflateInit2_', 'inflateEnd', '__errno_location', 'read', 'crc32', 'cups_read', 'inflate']	30	63	cups_fill	call site: 00354	/src/cups/cups/file.c:2066
28	28	1 : View List ['cupsFileFlush']	68	68	cupsFileClose	call site: 00119	/src/cups/cups/file.c:313
28	28	3 : View List ['cups_write', 'deflate', 'deflateEnd']	38	38	cupsFileClose	call site: 00120	/src/cups/cups/file.c:320
22	22	1 : View List ['cups_set_user']	51	480	cups_finalize_client_conf	call site: 00512	/src/cups/cups/usersys.c:1282
16	16	1 : View List ['cups_set_encryption']	88	539	cups_finalize_client_conf	call site: 00506	/src/cups/cups/usersys.c:1268
15	15	1 : View List ['cups_boolean_value']	27	456	cups_finalize_client_conf	call site: 00514	/src/cups/cups/usersys.c:1285
12	12	1 : View List ['validate_end']	12	12	cupsCopyString	call site: 00031	/src/cups/cups/string.c:115
10	10	2 : View List ['close', 'httpAddrClose']	10	10	cupsFileOpen	call site: 00034	/src/cups/cups/file.c:1007
8	8	1 : View List ['_cupsMessageFree']	8	32	cupsLangGet	call site: 00239	/src/cups/cups/language.c:559

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

129

Reachable functions

187

Percentage of reachable functions covered

31.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ipp.c	2
/src/cups/cups/file.c	12
/src/cups/cups/string.c	8
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	8
/src/cups/cups/http.c	10
/src/cups/cups/./tls-openssl.c	4
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	1
/src/cups/cups/./string-private.h	4
/src/cups/cups/request.c	1
/src/cups/cups/language.c	14
/src/cups/cups/ipp.c	14
/src/cups/cups/usersys.c	13
/src/cups/cups/tls.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

153 / 155

Cyclomatic complexity statically reachable by fuzzers

1486 / 1511

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/cups/ossfuzz/fuzz_array.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsArrayAdd', 'LLVMFuzzerTestOneInput', 'cupsArrayCurrent', 'cupsArrayGetLast', 'cupsArrayFind']

/src/cups/ossfuzz/fuzz_raster.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsCopyString', 'cups_globals_init', '_cupsRasterNew', 'cups_globals_alloc', 'cups_read_fd', 'cups_raster_update', '_cupsRasterAddError']

/src/cups/ossfuzz/fuzz_cups.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsCopyString', 'cups_globals_init', 'error_object', 'cups_globals_alloc', '_cupsRasterExecPS', 'new_stack']

/src/cups/ossfuzz/fuzz_ipp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsMutexUnlock', '_cupsLangString', '_cupsStrAlloc', 'cups_set_server_name', 'cups_fill', '_cupsSetDefaults', 'cupsFileOpen', '_cups_tolower', '_cupsGlobals']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
_cupsRasterNew	81	44	54.32%	['fuzz_raster']
cupsFileClose	66	25	37.87%	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']
cupsFileOpen	66	24	36.36%	['fuzz_ipp']
cupsFileOpenFd	60	19	31.66%	['fuzz_ipp']
_cupsMessageLoad	75	18	24.0%	['fuzz_ipp']
cupsSetServer	49	20	40.81%	['fuzz_ipp']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/cups/cups/file.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	['fuzz_ipp']
/src/cups/cups/./tls-openssl.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/usr/include/openssl/x509.h	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/src/cups/ossfuzz/fuzz_cups.c	['fuzz_cups']	['fuzz_cups']
/src/cups/cups/options.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/src/cups/cups/usersys.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/cups/ipp.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/cups/string.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']
/src/cups/cups/globals.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']
/src/cups/cups/request.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/ossfuzz/fuzz_helpers.cpp	['fuzz_array']	['fuzz_array']
/src/cups/cups/array.c	['fuzz_array', 'fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	['fuzz_array', 'fuzz_ipp']
/src/cups/cups/raster-stream.c	['fuzz_raster']	['fuzz_raster']
/src/cups/cups/raster-stubs.c	['fuzz_raster']	['fuzz_raster']
/src/cups/cups/http-addr.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/src/cups/cups/http-addrlist.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/src/cups/cups/thread.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	['fuzz_ipp']
/src/cups/cups/raster-error.c	['fuzz_raster', 'fuzz_cups']	['fuzz_raster', 'fuzz_cups']
/src/cups/cups/./string-private.h	['fuzz_cups', 'fuzz_ipp']	[]
/src/cups/cups/http.c	['fuzz_raster', 'fuzz_cups', 'fuzz_ipp']	[]
/src/cups/cups/raster-interpret.c	['fuzz_cups']	['fuzz_cups']
/src/cups/ossfuzz/fuzz_ipp.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/cups/tls.c	['fuzz_ipp']	['fuzz_ipp']
/usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/limits	[]	[]
/src/cups/cups/language.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/ossfuzz/fuzz_array.c	['fuzz_array']	['fuzz_array']
/src/cups/ossfuzz/fuzz_raster.c	['fuzz_raster']	['fuzz_raster']

Directories in report

Directory
/src/cups/cups/./
/usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/
/src/cups/cups/
/src/cups/ossfuzz/
/usr/include/openssl/