High level conclusions

Fuzzers reach 99.39% of cyclomatic complexity.

Fuzzers reach 99.37% of all functions.

Fuzzers reach 77.25% code coverage.

Fuzzer fuzz_ppd_gen_conflicts is blocked:

The runtime code coverage of fuzz_ppd_gen_conflicts covers 23.68% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_cups is blocked:

The runtime code coverage of fuzz_cups covers 26.50% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_raster is blocked:

The runtime code coverage of fuzz_raster covers 22.22% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

319 / 321

Cyclomatic complexity statically reachable by fuzzers

4124 / 4149

Runtime code coverage of functions

248 / 321

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_raster

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	85	54.4%
gold	[1:9]	24	15.3%
yellow	[10:29]	2	1.28%
greenyellow	[30:49]	1	0.64%
lawngreen	50+	44	28.2%
All colors	156	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	12	1 : View List ['validate_end']	12	12	cupsCopyString	call site: 00088	/src/cups/cups/string.c:115
4	241	3 : View List ['strerror', '__errno_location', '_cupsRasterAddError']	4	241	cups_raster_update	call site: 00148	/src/cups/cups/raster-stream.c:1874
4	4	1 : View List ['htonl']	8	486	_cupsRasterNew	call site: 00102	/src/cups/cups/raster-stream.c:794
2	2	1 : View List ['realloc']	2	2	_cupsRasterAddError	call site: 00104	/src/cups/cups/raster-error.c:66
2	2	1 : View List ['realloc']	2	2	cups_raster_read	call site: 00133	/src/cups/cups/raster-stream.c:1617
0	0	None	36	56	cups_globals_alloc	call site: 00071	/src/cups/cups/globals.c:182
0	0	None	16	36	cups_globals_alloc	call site: 00075	/src/cups/cups/globals.c:308
0	0	None	12	32	cups_globals_alloc	call site: 00082	/src/cups/cups/globals.c:353
0	0	1 : View List ['free']	6	243	cups_raster_update	call site: 00147	/src/cups/cups/raster-stream.c:1871
0	0	None	4	241	_cupsRasterNew	call site: 00099	/src/cups/cups/raster-stream.c:783
0	0	None	0	270	cupsRasterOpen	call site: 00008	/src/cups/cups/raster-stubs.c:111
0	0	None	0	0	_cupsRasterAddError	call site: 00104	/src/cups/cups/raster-error.c:44

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

63

Reachable functions

81

Percentage of reachable functions covered

22.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_raster.c	2
/src/cups/cups/raster-stubs.c	5
/src/cups/cups/raster-stream.c	6
/src/cups/cups/raster-error.c	2
/src/cups/cups/globals.c	4
/src/cups/cups/string.c	3
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	4
/src/cups/cups/http.c	2
/src/cups/cups/./tls-openssl.c	2
/src/cups/cups/http-addr.c	1
/src/cups/cups/http-addrlist.c	1
/usr/include/openssl/x509.h	1
/src/cups/cups/file.c	4
/src/cups/cups/options.c	1

Fuzzer: fuzz_array

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	25.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	74.1%
All colors	58	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['realloc']	2	19	cups_array_add	call site: 00019	/src/cups/cups/array.c:1030
0	0	None	2	2	cupsArrayDup	call site: 00043	/src/cups/cups/array.c:296
0	0	None	0	40	cupsArrayAdd	call site: 00018	/src/cups/cups/array.c:78
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:363
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:367
0	0	None	0	17	cupsArrayFind	call site: 00038	/src/cups/cups/array.c:371
0	0	None	0	17	cupsArrayRemove	call site: 00045	/src/cups/cups/array.c:897
0	0	None	0	17	cupsArrayRemove	call site: 00045	/src/cups/cups/array.c:901
0	0	None	0	17	cups_array_add	call site: 00020	/src/cups/cups/array.c:1047
0	0	None	0	17	cups_array_add	call site: 00020	/src/cups/cups/array.c:1059
0	0	None	0	6	cupsArrayGetFirst	call site: 00025	/src/cups/cups/array.c:507
0	0	None	0	6	cupsArrayGetLast	call site: 00032	/src/cups/cups/array.c:562

Runtime coverage analysis

Covered functions

24

Functions that are reachable but not covered

9

Reachable functions

33

Percentage of reachable functions covered

72.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_array.c	1
/src/cups/ossfuzz/fuzz_helpers.cpp	1
/src/cups/cups/array.c	22

Fuzzer: fuzz_http_core

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	305	63.1%
gold	[1:9]	42	8.69%
yellow	[10:29]	10	2.07%
greenyellow	[30:49]	8	1.65%
lawngreen	50+	118	24.4%
All colors	483	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
903	903	2 : View List ['_cupsLangString', 'cupsLangDefault']	903	990	_cupsSetError	call site: 00197	/src/cups/cups/request.c:1125
6	6	1 : View List ['strcmp']	10	40	httpAssembleURI	call site: 00026	/src/cups/cups/http-support.c:267
4	4	2 : View List ['strerror', '__errno_location']	907	1366	_cupsSetError	call site: 00193	/src/cups/cups/request.c:1107
2	2	1 : View List ['__res_init']	82	5496	httpAddrGetList	call site: 00175	/src/cups/cups/http-addrlist.c:520
2	2	1 : View List ['strlen']	4	34	httpAssembleURI	call site: 00028	/src/cups/cups/http-support.c:274
2	2	1 : View List ['realloc']	2	19	cups_array_add	call site: 00306	/src/cups/cups/array.c:1030
2	2	1 : View List ['strlen']	2	2	httpAddrGetLength	call site: 00368	/src/cups/cups/http-addr.c:168
2	2	1 : View List ['__ctype_b_loc']	2	2	httpDecode64_3	call site: 00169	/src/cups/cups/http-support.c:537
0	20	1 : View List ['cupsCopyString']	0	20	httpAddrGetString	call site: 00460	/src/cups/cups/http-addr.c:560
0	15	1 : View List ['http_copy_encode']	0	15	httpAssembleURI	call site: 00032	/src/cups/cups/http-support.c:295
0	0	None	66	4650	httpAddrGetList	call site: 00187	/src/cups/cups/http-addrlist.c:622
0	0	None	58	4640	httpAddrGetList	call site: 00192	/src/cups/cups/http-addrlist.c:658

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

118

Reachable functions

171

Percentage of reachable functions covered

30.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_http_core.c	8
/src/cups/cups/http.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-support.c	10
/src/cups/cups/string.c	7
/src/cups/cups/./string-private.h	3
/src/cups/cups/array.c	8
/src/cups/cups/http-addr.c	9
/src/cups/cups/http-addrlist.c	4
/usr/include/openssl/x509.h	1
/src/cups/cups/file.c	10
/src/cups/cups/options.c	1
/src/cups/cups/request.c	1
/src/cups/cups/language.c	14

Fuzzer: fuzz_cups

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	76	31.5%
gold	[1:9]	19	7.88%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	60.5%
All colors	241	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	36	56	cups_globals_alloc	call site: 00065	/src/cups/cups/globals.c:182
0	0	None	16	36	cups_globals_alloc	call site: 00069	/src/cups/cups/globals.c:308
0	0	None	12	32	cups_globals_alloc	call site: 00076	/src/cups/cups/globals.c:353
0	0	None	10	36	_cupsStrScand	call site: 00112	/src/cups/cups/string.c:855
0	0	None	6	6	_cupsStrScand	call site: 00114	/src/cups/cups/string.c:892
0	0	None	0	237	_cupsRasterExecPS	call site: 00003	/src/cups/cups/raster-interpret.c:519
0	0	None	0	237	_cupsRasterExecPS	call site: 00095	/src/cups/cups/raster-interpret.c:525
0	0	None	0	5	copy_stack	call site: 00142	/src/cups/cups/raster-interpret.c:729
0	0	None	0	0	_cupsRasterAddError	call site: 00093	/src/cups/cups/raster-error.c:44
0	0	None	0	0	_cupsRasterAddError	call site: 00093	/src/cups/cups/raster-error.c:51
0	0	None	0	0	_cupsRasterAddError	call site: 00094	/src/cups/cups/raster-error.c:71
0	0	None	0	0	push_stack	call site: 00134	/src/cups/cups/raster-interpret.c:943

Runtime coverage analysis

Covered functions

22

Functions that are reachable but not covered

61

Reachable functions

83

Percentage of reachable functions covered

26.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_cups.c	1
/src/cups/cups/raster-interpret.c	13
/src/cups/cups/raster-error.c	1
/src/cups/cups/globals.c	4
/src/cups/cups/string.c	4
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	4
/src/cups/cups/http.c	2
/src/cups/cups/./tls-openssl.c	2
/src/cups/cups/http-addr.c	1
/src/cups/cups/http-addrlist.c	1
/usr/include/openssl/x509.h	1
/src/cups/cups/file.c	4
/src/cups/cups/options.c	1
/src/cups/cups/./string-private.h	1

Fuzzer: fuzz_ipp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	390	60.3%
gold	[1:9]	99	15.3%
yellow	[10:29]	17	2.63%
greenyellow	[30:49]	2	0.30%
lawngreen	50+	138	21.3%
All colors	646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
300	483	10 : View List ['cups_unquote', 'cupsFileClose', 'strrchr', 'cups_read_strings', 'strncmp', 'cupsConcatString', 'strchr', 'cupsFileGets', 'cupsArrayAdd', 'cupsCopyString']	300	483	_cupsMessageLoad	call site: 00219	/src/cups/cups/language.c:699
213	270	2 : View List ['cupsFileClose', 'cups_read_client_conf']	536	1360	_cupsSetDefaults	call site: 00464	/src/cups/cups/usersys.c:1111
37	37	1 : View List ['httpClose']	37	37	cupsSetServer	call site: 00515	/src/cups/cups/usersys.c:603
30	63	7 : View List ['cups_read', 'inflateEnd', 'crc32', '__errno_location', 'read', 'inflateInit2_', 'inflate']	30	63	cups_fill	call site: 00307	/src/cups/cups/file.c:2066
28	28	1 : View List ['cupsFileFlush']	68	68	cupsFileClose	call site: 00067	/src/cups/cups/file.c:313
28	28	3 : View List ['cups_write', 'deflateEnd', 'deflate']	38	38	cupsFileClose	call site: 00068	/src/cups/cups/file.c:320
22	22	1 : View List ['cups_set_browse_domains']	194	527	cups_finalize_client_conf	call site: 00468	/src/cups/cups/usersys.c:1415
22	22	1 : View List ['cups_set_filter_location']	170	503	cups_finalize_client_conf	call site: 00470	/src/cups/cups/usersys.c:1418
22	22	1 : View List ['cups_set_filter_type']	146	479	cups_finalize_client_conf	call site: 00472	/src/cups/cups/usersys.c:1421
22	22	1 : View List ['cups_set_user']	51	362	cups_finalize_client_conf	call site: 00484	/src/cups/cups/usersys.c:1444
16	16	1 : View List ['cups_set_encryption']	88	421	cups_finalize_client_conf	call site: 00478	/src/cups/cups/usersys.c:1430
15	15	1 : View List ['cups_boolean_value']	27	338	cups_finalize_client_conf	call site: 00486	/src/cups/cups/usersys.c:1447

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

127

Reachable functions

185

Percentage of reachable functions covered

31.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ipp.c	2
/src/cups/cups/file.c	12
/src/cups/cups/string.c	8
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	12
/src/cups/cups/http.c	3
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	1
/src/cups/cups/./string-private.h	4
/src/cups/cups/request.c	1
/src/cups/cups/language.c	14
/src/cups/cups/ipp.c	14
/src/cups/cups/usersys.c	16
/src/cups/cups/tls.c	1

Fuzzer: fuzz_ipp_gen

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	390	59.6%
gold	[1:9]	94	14.3%
yellow	[10:29]	18	2.75%
greenyellow	[30:49]	1	0.15%
lawngreen	50+	151	23.0%
All colors	654	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
300	483	10 : View List ['cups_unquote', 'cupsFileClose', 'strrchr', 'cups_read_strings', 'strncmp', 'cupsConcatString', 'strchr', 'cupsFileGets', 'cupsArrayAdd', 'cupsCopyString']	300	483	_cupsMessageLoad	call site: 00215	/src/cups/cups/language.c:699
213	270	2 : View List ['cupsFileClose', 'cups_read_client_conf']	536	1360	_cupsSetDefaults	call site: 00470	/src/cups/cups/usersys.c:1111
108	4144	10 : View List ['strerror', 'ippSetValueTag', 'ippAddSeparator', 'ipp_add_attr', 'malloc', '__errno_location', '_cupsStrAlloc', 'ipp_set_value', 'ipp_read_io', 'ippNew']	108	26213	ipp_read_io	call site: 00573	/src/cups/cups/ipp.c:5464
37	37	1 : View List ['httpClose']	37	37	cupsSetServer	call site: 00521	/src/cups/cups/usersys.c:603
22	22	1 : View List ['cups_set_browse_domains']	194	527	cups_finalize_client_conf	call site: 00474	/src/cups/cups/usersys.c:1415
22	22	1 : View List ['cups_set_filter_location']	170	503	cups_finalize_client_conf	call site: 00476	/src/cups/cups/usersys.c:1418
22	22	1 : View List ['cups_set_filter_type']	146	479	cups_finalize_client_conf	call site: 00478	/src/cups/cups/usersys.c:1421
22	22	1 : View List ['cups_set_user']	51	362	cups_finalize_client_conf	call site: 00490	/src/cups/cups/usersys.c:1444
22	22	1 : View List ['cups_compress']	22	22	cupsFileFlush	call site: 00064	/src/cups/cups/file.c:546
22	22	1 : View List ['cups_compress']	22	22	cupsFileWrite	call site: 00385	/src/cups/cups/file.c:1825
16	16	1 : View List ['cups_set_encryption']	88	421	cups_finalize_client_conf	call site: 00484	/src/cups/cups/usersys.c:1430
15	15	1 : View List ['cups_boolean_value']	27	338	cups_finalize_client_conf	call site: 00492	/src/cups/cups/usersys.c:1447

Runtime coverage analysis

Covered functions

60

Functions that are reachable but not covered

121

Reachable functions

181

Percentage of reachable functions covered

33.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ipp_gen.c	1
/src/cups/cups/file.c	13
/src/cups/cups/string.c	8
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	12
/src/cups/cups/http.c	3
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	1
/src/cups/cups/./string-private.h	4
/src/cups/cups/request.c	1
/src/cups/cups/language.c	14
/src/cups/cups/ipp.c	14
/src/cups/cups/usersys.c	16
/src/cups/cups/tls.c	1

Fuzzer: fuzz_ppd_gen_1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	855	52.3%
gold	[1:9]	15	0.91%
yellow	[10:29]	9	0.55%
greenyellow	[30:49]	7	0.42%
lawngreen	50+	748	45.7%
All colors	1634	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2026	2192	5 : View List ['_ppdCacheGetInputSlot', '_cups_strncasecmp', '_ppdCacheGetPageSize', 'ppdPageSize', '_ppdCacheGetMediaType']	2894	11973	cupsMarkOptions	call site: 01144	/src/cups/cups/ppd-mark.c:99
28	28	1 : View List ['cupsFileFlush']	68	68	cupsFileClose	call site: 00077	/src/cups/cups/file.c:313
28	28	3 : View List ['cups_write', 'deflateEnd', 'deflate']	38	38	cupsFileClose	call site: 00078	/src/cups/cups/file.c:320
26	26	2 : View List ['_ppdCacheGetOutputBin', 'strcmp']	868	8205	cupsMarkOptions	call site: 01576	/src/cups/cups/ppd-mark.c:141
19	31	7 : View List ['cupsMutexUnlock', '_cupsCharmapFlush', '_cupsEncodingName', 'cupsMutexLock', 'strlen', 'iconv_open', 'iconv']	19	31	cupsCharsetToUTF8	call site: 00479	/src/cups/cups/transcode.c:115
16	16	1 : View List ['_ppdCacheDestroy']	16	16	ppdClose	call site: 00883	/src/cups/cups/ppd.c:257
10	57	9 : View List ['_cups_isspace', 'ppdFindNextAttr', 'strdup', 'strncmp', '__isoc99_sscanf', '_cups_strcpy', 'realloc', 'strchr', 'malloc']	10	57	ppd_update_filters	call site: 00893	/src/cups/cups/ppd.c:3461
10	10	2 : View List ['close', 'httpAddrClose']	10	10	cupsFileOpen	call site: 00044	/src/cups/cups/file.c:1007
8	8	1 : View List ['_cupsMessageFree']	8	32	cupsLangGet	call site: 00202	/src/cups/cups/language.c:560
8	8	1 : View List ['httpAddrClose']	8	8	cupsFileClose	call site: 00091	/src/cups/cups/file.c:386
8	8	3 : View List ['__errno_location', 'read', 'recv']	8	8	cups_read	call site: 00307	/src/cups/cups/file.c:2296
2	1184	2 : View List ['atoi', 'ppd_mark_option']	2	1592	cupsMarkOptions	call site: 01626	/src/cups/cups/ppd-mark.c:332

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

162

Reachable functions

262

Percentage of reachable functions covered

38.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ppd_gen_1.c	1
/src/cups/cups/ppd.c	27
/src/cups/cups/file.c	12
/src/cups/cups/string.c	11
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	26
/src/cups/cups/http.c	3
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	8
/src/cups/cups/./string-private.h	6
/src/cups/cups/request.c	1
/src/cups/cups/language.c	15
/src/cups/cups/transcode.c	2
/src/cups/cups/ppd-custom.c	2
/src/cups/cups/ppd-mark.c	10
/src/cups/cups/ppd-attr.c	2
/src/cups/cups/ppd-page.c	1
/src/cups/cups/ppd-cache.c	12
/src/cups/cups/ppd-conflicts.c	4
/src/cups/cups/pwg-media.c	13
/src/cups/cups/ipp.c	5

Fuzzer: fuzz_ppd_gen_conflicts

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1308	76.4%
gold	[1:9]	19	1.11%
yellow	[10:29]	7	0.40%
greenyellow	[30:49]	8	0.46%
lawngreen	50+	369	21.5%
All colors	1711	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
142	248	5 : View List ['cupsArrayNew2', 'ppd_update_filters', 'ppdFindCustomOption', 'cupsArrayNew', 'cupsArrayAdd']	142	305	_ppdOpen	call site: 00854	/src/cups/cups/ppd.c:2070
66	236	5 : View List ['ppdFindCustomOption', 'strcmp', '_cupsStrScand', 'ppdFindCustomParam', 'localeconv']	66	296	ppdPageSize	call site: 00810	/src/cups/cups/ppd-page.c:46
28	28	1 : View List ['cupsFileFlush']	68	68	cupsFileClose	call site: 00077	/src/cups/cups/file.c:313
28	28	3 : View List ['cups_write', 'deflateEnd', 'deflate']	38	38	cupsFileClose	call site: 00078	/src/cups/cups/file.c:320
19	31	7 : View List ['cupsMutexUnlock', '_cupsCharmapFlush', '_cupsEncodingName', 'cupsMutexLock', 'strlen', 'iconv_open', 'iconv']	19	31	cupsCharsetToUTF8	call site: 00479	/src/cups/cups/transcode.c:115
16	16	1 : View List ['_ppdCacheDestroy']	16	16	ppdClose	call site: 00883	/src/cups/cups/ppd.c:257
10	10	2 : View List ['close', 'httpAddrClose']	10	10	cupsFileOpen	call site: 00044	/src/cups/cups/file.c:1007
8	8	1 : View List ['_cupsMessageFree']	8	32	cupsLangGet	call site: 00202	/src/cups/cups/language.c:560
8	8	1 : View List ['httpAddrClose']	8	8	cupsFileClose	call site: 00091	/src/cups/cups/file.c:386
8	8	3 : View List ['__errno_location', 'read', 'recv']	8	8	cups_read	call site: 00307	/src/cups/cups/file.c:2296
2	2	1 : View List ['strtol']	1626	1686	cupsFileOpen	call site: 00019	/src/cups/cups/file.c:944
2	2	1 : View List ['realloc']	2	78	ppd_get_group	call site: 00474	/src/cups/cups/ppd.c:2779

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

203

Reachable functions

266

Percentage of reachable functions covered

23.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ppd_gen_conflicts.c	1
/src/cups/cups/ppd.c	27
/src/cups/cups/file.c	12
/src/cups/cups/string.c	12
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	27
/src/cups/cups/http.c	3
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	8
/src/cups/cups/./string-private.h	6
/src/cups/cups/request.c	1
/src/cups/cups/language.c	15
/src/cups/cups/transcode.c	2
/src/cups/cups/ppd-custom.c	2
/src/cups/cups/ppd-mark.c	9
/src/cups/cups/ppd-attr.c	2
/src/cups/cups/ppd-page.c	1
/src/cups/cups/ppd-cache.c	12
/src/cups/cups/ppd-conflicts.c	6
/src/cups/cups/pwg-media.c	13
/src/cups/cups/ipp.c	5

Fuzzer: fuzz_ppd_gen_cache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	992	45.1%
gold	[1:9]	112	5.09%
yellow	[10:29]	27	1.22%
greenyellow	[30:49]	4	0.18%
lawngreen	50+	1062	48.3%
All colors	2197	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
813	813	1 : View List ['cupsHashData']	2095	11113	_cupsConvertOptions	call site: 02017	/src/cups/cups/ppd-cache.c:95
334	384	3 : View List ['ippLength', 'ippWriteIO', 'cupsFilePrintf']	340	447	_ppdCacheWriteFile	call site: 01698	/src/cups/cups/ppd-cache.c:3160
225	483	10 : View List ['cups_unquote', 'cupsFileClose', 'strrchr', 'cups_read_strings', 'strncmp', 'cupsConcatString', 'strchr', 'cupsFileGets', 'cupsArrayAdd', 'cupsCopyString']	225	483	_cupsMessageLoad	call site: 00239	/src/cups/cups/language.c:699
213	270	2 : View List ['cupsFileClose', 'cups_read_client_conf']	536	1360	_cupsSetDefaults	call site: 01453	/src/cups/cups/usersys.c:1111
182	956	4 : View List ['_ppdParseOptions', 'calloc', '_ppdCacheDestroy', '_cupsSetError']	295	2147	_ppdCacheCreateWithPPD	call site: 01148	/src/cups/cups/ppd-cache.c:1835
156	185	2 : View List ['pwg_add_finishing', 'ppdFindChoice']	267	1295	_ppdCacheCreateWithPPD	call site: 01218	/src/cups/cups/ppd-cache.c:1950
103	103	1 : View List ['cupsArrayNewStrings']	103	277	_ppdCacheCreateWithPPD	call site: 01246	/src/cups/cups/ppd-cache.c:2037
102	1321	4 : View List ['ippAddCollection', 'ippNew', 'ippDelete', 'ippAddString']	102	1439	_cupsConvertOptions	call site: 02182	/src/cups/cups/ppd-cache.c:436
37	37	1 : View List ['httpClose']	37	37	cupsSetServer	call site: 01503	/src/cups/cups/usersys.c:603
22	22	1 : View List ['cups_set_browse_domains']	194	527	cups_finalize_client_conf	call site: 01457	/src/cups/cups/usersys.c:1415
22	22	1 : View List ['cups_set_filter_location']	170	503	cups_finalize_client_conf	call site: 01459	/src/cups/cups/usersys.c:1418
22	22	1 : View List ['cups_set_filter_type']	146	479	cups_finalize_client_conf	call site: 01461	/src/cups/cups/usersys.c:1421

Runtime coverage analysis

Covered functions

164

Functions that are reachable but not covered

182

Reachable functions

346

Percentage of reachable functions covered

47.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/cups/ossfuzz/fuzz_ppd_gen_cache.c	5
/src/cups/cups/ppd.c	27
/src/cups/cups/file.c	22
/src/cups/cups/string.c	11
/src/cups/cups/http-addrlist.c	4
/src/cups/cups/globals.c	6
/src/cups/cups/thread.c	2
/src/cups/cups/array.c	24
/src/cups/cups/http.c	3
/src/cups/cups/./tls-openssl.c	3
/src/cups/cups/http-addr.c	5
/usr/include/openssl/x509.h	1
/src/cups/cups/options.c	8
/src/cups/cups/./string-private.h	6
/src/cups/cups/request.c	1
/src/cups/cups/language.c	15
/src/cups/cups/transcode.c	2
/src/cups/cups/ppd-custom.c	2
/src/cups/cups/ppd-mark.c	4
/src/cups/cups/ppd-attr.c	2
/src/cups/cups/ppd-page.c	1
/src/cups/cups/ppd-cache.c	21
/src/cups/cups/pwg-media.c	13
/src/cups/cups/ipp.c	36
/src/cups/cups/usersys.c	16
/src/cups/cups/tls.c	1
/src/cups/cups/hash.c	2
/src/cups/cups/md5.c	4
/src/cups/cups/encode.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

319 / 321

Cyclomatic complexity statically reachable by fuzzers

4124 / 4149

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/cups/ossfuzz/fuzz_raster.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cups_globals_init', 'cupsCopyString', '_cupsRasterNew', 'cups_read_fd', 'cups_globals_alloc', 'cups_raster_update', '_cupsRasterAddError', 'cups_raster_read']

/src/cups/ossfuzz/fuzz_array.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsArrayAdd', 'LLVMFuzzerTestOneInput', 'cupsArrayCurrent', 'cupsArrayGetLast', 'cupsArrayFind']

/src/cups/ossfuzz/fuzz_http_core.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['httpAddrLength', '_cupsSetError', '_cupsStrFree', 'cupsArrayNew3', 'httpAddrGetList', 'cups_globals_alloc', 'httpAssembleURI']

/src/cups/ossfuzz/fuzz_cups.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cups_globals_init', 'error_object', 'cupsCopyString', 'cups_globals_alloc', '_cupsRasterExecPS', 'new_stack']

/src/cups/ossfuzz/fuzz_ipp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cupsLangString', '_cupsStrAlloc', 'cups_set_server_name', '_cupsSetDefaults', 'cupsMutexUnlock', 'cups_fill', 'cupsFileOpen', '_cups_tolower']

/src/cups/ossfuzz/fuzz_ipp_gen.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cupsLangString', '_cupsStrAlloc', 'cups_set_server_name', '_cupsSetDefaults', 'cups_fill', 'cupsMutexUnlock', '_cups_tolower', 'cups_globals_alloc']

/src/cups/ossfuzz/fuzz_ppd_gen_1.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cupsMarkOptions', 'cups_fill', 'cupsFreeOptions', '_cupsStrAlloc', 'cupsMutexUnlock', '_cups_tolower', 'cupsArrayNew3', 'cupsFileOpen', 'cupsLangGet', 'cupsCharsetToUTF8']

/src/cups/ossfuzz/fuzz_ppd_gen_conflicts.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'cups_fill', 'cupsFileClose', 'ppdClose', 'cups_array_add', 'cupsArrayGetNext', 'cupsMutexUnlock', '_cups_tolower', 'cupsArrayNew3', '_ppdOpen']

/src/cups/ossfuzz/fuzz_ppd_gen_cache.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_ppdCacheCreateWithFile', '_ppdCacheWriteFile', '_cupsConvertOptions', '_cupsLangString', '_cupsStrAlloc', 'cups_set_server_name', 'cups_fill', 'cupsFileGetConf', 'cupsMutexUnlock']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
cups_globals_alloc	89	41	46.06%	['fuzz_ppd_gen_1', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_http_core', 'fuzz_raster', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts', 'fuzz_cups']
_cupsRasterNew	81	44	54.32%	['fuzz_raster']
cupsFileOpen	66	35	53.03%	['fuzz_ppd_gen_1', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_http_core', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
_cupsMessageLoad	75	18	24.0%	['fuzz_ppd_gen_1', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_http_core', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
cupsSetServer	49	20	40.81%	['fuzz_ppd_gen_cache', 'fuzz_ipp', 'fuzz_ipp_gen']
_cupsSetDefaults	199	53	26.63%	['fuzz_ppd_gen_cache', 'fuzz_ipp', 'fuzz_ipp_gen']
cups_open	45	21	46.66%	['fuzz_ppd_gen_1', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_http_core', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
cupsMarkOptions	183	48	26.22%	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts']
cupsCharsetToUTF8	66	34	51.51%	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
cupsFilePrintf	58	29	50.0%	['fuzz_ppd_gen_cache']
ippFindNextAttribute	84	34	40.47%	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
_cupsConvertOptions	288	83	28.81%	['fuzz_ppd_gen_cache']
_ppdCacheCreateWithFile	430	155	36.04%	['fuzz_ppd_gen_cache']
_ppdCacheCreateWithPPD	698	352	50.42%	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']
_ppdCacheGetFinishingOptions	37	10	27.02%	['fuzz_ppd_gen_cache']
_ppdCacheGetFinishingValues	48	14	29.16%	['fuzz_ppd_gen_cache']
pwgInitSize	114	50	43.85%	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_cache', 'fuzz_ppd_gen_conflicts']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/cups/cups/ppd-conflicts.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts']	['fuzz_ppd_gen_1']
/src/cups/cups/raster-stream.c	['fuzz_raster']	['fuzz_raster']
/src/cups/cups/ppd-attr.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_http_core.c	['fuzz_http_core']	['fuzz_http_core']
/src/cups/ossfuzz/fuzz_ppd_gen_conflicts.c	['fuzz_ppd_gen_conflicts']	['fuzz_ppd_gen_conflicts']
/src/cups/cups/options.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_cache']
/src/cups/cups/ppd-page.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/request.c	['fuzz_http_core', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_http_core', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_cups.c	['fuzz_cups']	['fuzz_cups']
/src/cups/cups/tls.c	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']
/src/cups/cups/hash.c	['fuzz_ppd_gen_cache']	[]
/src/cups/ossfuzz/fuzz_ppd_gen_1.c	['fuzz_ppd_gen_1']	['fuzz_ppd_gen_1']
/src/cups/ossfuzz/fuzz_ipp.c	['fuzz_ipp']	['fuzz_ipp']
/src/cups/ossfuzz/fuzz_ppd_gen_cache.c	['fuzz_ppd_gen_cache']	['fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_ipp_gen.c	['fuzz_ipp_gen']	['fuzz_ipp_gen']
/src/cups/cups/language.c	['fuzz_http_core', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/http-addrlist.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_http_core']
/src/cups/cups/ppd.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/thread.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_http_core', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/limits	[]	[]
/src/cups/cups/usersys.c	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']
/src/cups/cups/pwg-media.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_raster.c	['fuzz_raster']	['fuzz_raster']
/src/cups/cups/transcode.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/raster-error.c	['fuzz_raster', 'fuzz_cups']	['fuzz_raster', 'fuzz_cups']
/src/cups/cups/ppd-mark.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/md5.c	['fuzz_ppd_gen_cache']	[]
/src/cups/cups/ipp.c	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']
/src/cups/cups/ppd-custom.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/http-addr.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_http_core']
/src/cups/cups/./tls-openssl.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	[]
/src/cups/cups/raster-stubs.c	['fuzz_raster']	['fuzz_raster']
/src/cups/cups/raster-interpret.c	['fuzz_cups']	['fuzz_cups']
/src/cups/cups/globals.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_cache']
/src/cups/cups/file.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_helpers.cpp	['fuzz_array']	['fuzz_array']
/src/cups/cups/./string-private.h	['fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	[]
/src/cups/cups/string.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/ppd-cache.c	['fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_ppd_gen_cache']
/src/cups/ossfuzz/fuzz_array.c	['fuzz_array']	['fuzz_array']
/src/cups/cups/http-support.c	['fuzz_http_core']	['fuzz_http_core']
/src/cups/cups/array.c	['fuzz_raster', 'fuzz_array', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_array', 'fuzz_http_core', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']
/src/cups/cups/http.c	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	['fuzz_http_core']
/src/cups/cups/encode.c	['fuzz_ppd_gen_cache']	[]
/usr/include/openssl/x509.h	['fuzz_raster', 'fuzz_http_core', 'fuzz_cups', 'fuzz_ipp', 'fuzz_ipp_gen', 'fuzz_ppd_gen_1', 'fuzz_ppd_gen_conflicts', 'fuzz_ppd_gen_cache']	[]

Directories in report

Directory
/src/cups/cups/
/usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/
/src/cups/ossfuzz/
/usr/include/openssl/
/src/cups/cups/./