High level conclusions

Fuzzer curl_fuzzer_proto_ftp is blocked:

The runtime code coverage of curl_fuzzer_proto_ftp covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_proto_tftp is blocked:

The runtime code coverage of curl_fuzzer_proto_tftp covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_smb is blocked:

The runtime code coverage of curl_fuzzer_smb covers 11.18% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_proto_ws is blocked:

The runtime code coverage of curl_fuzzer_proto_ws covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_proto_api is blocked:

The runtime code coverage of curl_fuzzer_proto_api covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 13.41% of cyclomatic complexity.

Fuzzers reach 17.71% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1092 / 6163

Cyclomatic complexity statically reachable by fuzzers

4441 / 33093

Runtime code coverage of functions

2250 / 6163

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: curl_fuzzer_proto_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1544

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_api.cc	1

Fuzzer: curl_fuzzer_proto_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1555

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ws.cc	1

Fuzzer: curl_fuzzer_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1824	60.8%
gold	[1:9]	9	0.30%
yellow	[10:29]	13	0.43%
greenyellow	[30:49]	12	0.40%
lawngreen	50+	1139	38.0%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
41	2263	Curl_bufq_len	call site: 02263	Curl_debug
33	635	curlx_strcopy	call site: 00635	append
32	1655	mstate_connecting_pollset	call site: 01655	mstate_perform_pollset
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost

Runtime coverage analysis

Covered functions

2319

Functions that are reachable but not covered

684

Reachable functions

1287

Percentage of reachable functions covered

46.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_tftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_mqtt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1773	59.1%
gold	[1:9]	11	0.36%
yellow	[10:29]	27	0.90%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	1182	39.4%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
33	635	curlx_strcopy	call site: 00635	append
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
27	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add
25	2789	Curl_close	call site: 02789	share_unlink

Runtime coverage analysis

Covered functions

2366

Functions that are reachable but not covered

655

Reachable functions

1287

Percentage of reachable functions covered

49.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_mqtt.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_smtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1715	57.2%
gold	[1:9]	22	0.73%
yellow	[10:29]	17	0.56%
greenyellow	[30:49]	6	0.20%
lawngreen	50+	1237	41.2%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4485

Functions that are reachable but not covered

631

Reachable functions

1287

Percentage of reachable functions covered

50.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smtp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_imap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1705	56.8%
gold	[1:9]	27	0.90%
yellow	[10:29]	21	0.70%
greenyellow	[30:49]	56	1.86%
lawngreen	50+	1188	39.6%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4473

Functions that are reachable but not covered

624

Reachable functions

1287

Percentage of reachable functions covered

51.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_imap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	245	65.1%
gold	[1:9]	1	0.26%
yellow	[10:29]	12	3.19%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	118	31.3%
All colors	376	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
48	288	curl_url_cleanup	call site: 00288	url_sethost
37	249	Curl_urldecode	call site: 00249	checkurl
18	105	formatf	call site: 00105	out_double
18	126	curl_mvsnprintf	call site: 00126	curl_url_get
15	221	curlx_dyn_addn	call site: 00221	curl_maprintf
12	205	dyn_nappend	call site: 00205	curl_easy_escape
11	19	free_urlhandle	call site: 00019	curlx_strzero
8	94	out_number	call site: 00094	OUTCHAR
8	146	urlget_url	call site: 00146	file_url
8	170	curlx_dyn_ptr	call site: 00170	curlx_dyn_addf
6	36	Curl_get_scheme	call site: 00036	set_url_port
6	52	curl_url_set	call site: 00052	curl_url_set

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

92

Reachable functions

160

Percentage of reachable functions covered

42.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_url.cc	7
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/tests/libtest/lib1560.c	9
curl/lib/mprintf.c	33
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1858	61.9%
gold	[1:9]	22	0.73%
yellow	[10:29]	22	0.73%
greenyellow	[30:49]	11	0.36%
lawngreen	50+	1084	36.1%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
41	2263	Curl_bufq_len	call site: 02263	Curl_debug
33	635	curlx_strcopy	call site: 00635	append
32	1655	mstate_connecting_pollset	call site: 01655	mstate_perform_pollset
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost

Runtime coverage analysis

Covered functions

4302

Functions that are reachable but not covered

693

Reachable functions

1287

Percentage of reachable functions covered

46.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_https.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1722	57.4%
gold	[1:9]	12	0.40%
yellow	[10:29]	11	0.36%
greenyellow	[30:49]	1	0.03%
lawngreen	50+	1251	41.7%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
33	635	curlx_strcopy	call site: 00635	append
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add
25	2789	Curl_close	call site: 02789	share_unlink

Runtime coverage analysis

Covered functions

4487

Functions that are reachable but not covered

624

Reachable functions

1287

Percentage of reachable functions covered

51.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ws.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1912	63.7%
gold	[1:9]	26	0.86%
yellow	[10:29]	12	0.40%
greenyellow	[30:49]	61	2.03%
lawngreen	50+	986	32.8%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
110	1758	Curl_meta_set	call site: 01758	mev_pollset_diff
103	1530	Curl_xfer_recv_is_paused	call site: 01530	url_query
80	1026	wakeup_eventfd	call site: 01026	wakeup_inet
52	1417	cshutdn_run_conn_handler	call site: 01417	loghex
50	2915	curl_multi_perform	call site: 02915	curl_multi_perform
49	2252	prune_head	call site: 02252	xfer_send
48	1964	cshutdn_perform	call site: 01964	Curl_conn_terminate
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
42	2573	Curl_close	call site: 02573	Curl_async_destroy

Runtime coverage analysis

Covered functions

1927

Functions that are reachable but not covered

776

Reachable functions

1287

Percentage of reachable functions covered

39.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_file.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_pop3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1759	58.6%
gold	[1:9]	20	0.66%
yellow	[10:29]	16	0.53%
greenyellow	[30:49]	64	2.13%
lawngreen	50+	1138	37.9%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4472

Functions that are reachable but not covered

636

Reachable functions

1287

Percentage of reachable functions covered

50.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_pop3.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: fuzz_bufq

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	462	88.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	12.0%
All colors	525	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
380	113	Curl_bufq_pass	call site: 00113	append
14	2	LLVMFuzzerTestOneInput	call site: 00002	allocate_template_buffer
12	99	bufq_slurpn	call site: 00099	Curl_bufq_pass
10	72	Curl_bufq_read	call site: 00072	Curl_bufq_slurp
10	498	Curl_bufq_skip	call site: 00498	Curl_bufq_write
8	59	chunk_peek_at	call site: 00059	Curl_bufq_read
7	49	chunk_peek	call site: 00049	Curl_bufq_peek_at
5	514	chunk_append	call site: 00514	Curl_bufq_free
4	27	Curl_bufq_init	call site: 00027	Curl_bufq_is_empty
4	35	Curl_bufq_len	call site: 00035	Curl_bufq_peek
2	24	bufq_init	call site: 00024	FV_PRINTF
2	32	Curl_bufq_is_empty	call site: 00032	Curl_bufq_len

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

24

Reachable functions

59

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_bufq.cc	32
curl/lib/bufq.c	29
curl/docs/examples/htmltitle.cpp	1
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/lib/mprintf.c	33
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1784	59.5%
gold	[1:9]	9	0.30%
yellow	[10:29]	20	0.66%
greenyellow	[30:49]	6	0.20%
lawngreen	50+	1178	39.3%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
27	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

2351

Functions that are reachable but not covered

648

Reachable functions

1287

Percentage of reachable functions covered

49.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_dict.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

9216

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto.cc	1

Fuzzer: curl_fuzzer_smb

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2628	87.6%
gold	[1:9]	3	0.10%
yellow	[10:29]	51	1.70%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	315	10.5%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
529	1355	Curl_pgrs_now	call site: 01355	Curl_conn_terminate
266	367	formadd	call site: 00367	fuzz_set_easy_options
248	1885	curlx_memzero	call site: 01885	Curl_async_shutdown
240	2136	curlx_dyn_reset	call site: 02136	Curl_req_done
220	917	inet_pton6	call site: 00917	fuzz_handle_transfer
124	2445	Curl_close	call site: 02445	curl_multi_cleanup
121	2856	Curl_close	call site: 02856	curl_multi_perform
74	1280	sigpipe_ignore	call site: 01280	cpool_discard_conn
66	2378	Curl_netrc_cleanup	call site: 02378	Curl_conn_close
53	814	Curl_urldecode	call site: 00814	checkurl
50	677	curlx_strzero	call site: 00677	curl_url_set
49	1196	Curl_llist_insert_next	call site: 01196	Curl_async_thrdd_multi_init

Runtime coverage analysis

Covered functions

1441

Functions that are reachable but not covered

1143

Reachable functions

1287

Percentage of reachable functions covered

11.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smb.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1587	52.9%
gold	[1:9]	28	0.93%
yellow	[10:29]	11	0.36%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	1367	45.6%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add
25	2789	Curl_close	call site: 02789	share_unlink

Runtime coverage analysis

Covered functions

4798

Functions that are reachable but not covered

582

Reachable functions

1287

Percentage of reachable functions covered

54.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: fuzz_doh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	28.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	32	71.1%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	doh_store_aaaa	call site: 00019	doh_store_https
3	34	LLVMFuzzerTestOneInput	call site: 00034	doh_req_encode
2	2	LLVMFuzzerTestOneInput	call site: 00002
2	29	doh_resp_decode	call site: 00029	de_cleanup
1	5	de_init	call site: 00005	doh_resp_decode
1	43	doh_req_encode	call site: 00043

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

16

Reachable functions

27

Percentage of reachable functions covered

40.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_doh.cc	10
curl/lib/vdns/doh.c	14
curl/lib/curlx/strdup.c	2

Fuzzer: curl_fuzzer_proto_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1555

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_tftp.cc	1

Fuzzer: curl_fuzzer_proto_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

6691

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_timing.cc	1

Fuzzer: curl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1874	62.5%
gold	[1:9]	84	2.80%
yellow	[10:29]	256	8.54%
greenyellow	[30:49]	26	0.86%
lawngreen	50+	757	25.2%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
261	367	formadd	call site: 00367	fuzz_set_easy_options
101	1552	curl_getenv	call site: 01552	curlx_dyn_addf
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
52	1417	cshutdn_run_conn_handler	call site: 01417	loghex
52	2152	pgrs_update	call site: 02152	timebuf
50	2915	curl_multi_perform	call site: 02915	curl_multi_perform
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
29	1654	Curl_multi_mark_dirty	call site: 01654	mstate_perform_pollset
28	873	curlx_dyn_add	call site: 00873	url_sethost

Runtime coverage analysis

Covered functions

2205

Functions that are reachable but not covered

687

Reachable functions

1287

Percentage of reachable functions covered

46.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_telnet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

5077

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_telnet.cc	1

Fuzzer: curl_fuzzer_rtsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1699	56.6%
gold	[1:9]	5	0.16%
yellow	[10:29]	7	0.23%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1277	42.6%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
33	635	curlx_strcopy	call site: 00635	append
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
26	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add
25	2789	Curl_close	call site: 02789	share_unlink

Runtime coverage analysis

Covered functions

2565

Functions that are reachable but not covered

620

Reachable functions

1287

Percentage of reachable functions covered

51.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_rtsp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1630	54.3%
gold	[1:9]	51	1.70%
yellow	[10:29]	11	0.36%
greenyellow	[30:49]	11	0.36%
lawngreen	50+	1294	43.1%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
33	635	curlx_strcopy	call site: 00635	append
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
25	2789	Curl_close	call site: 02789	share_unlink
23	1655	mstate_connecting_pollset	call site: 01655	mstate_protocol_pollset
22	1414	Curl_pgrsTime	call site: 01414	disconnect

Runtime coverage analysis

Covered functions

3144

Functions that are reachable but not covered

603

Reachable functions

1287

Percentage of reachable functions covered

53.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_http.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

9255

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https.cc	1

Fuzzer: curl_fuzzer_proto_wss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

7304

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_wss.cc	1

Fuzzer: curl_fuzzer_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1782	59.4%
gold	[1:9]	18	0.60%
yellow	[10:29]	21	0.70%
greenyellow	[30:49]	63	2.10%
lawngreen	50+	1113	37.1%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
37	1035	curlx_nonblock	call site: 01035	wakeup_inet
33	635	curlx_strcopy	call site: 00635	append
33	1073	Curl_poll	call site: 01073	Curl_poll
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
27	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4406

Functions that are reachable but not covered

646

Reachable functions

1287

Percentage of reachable functions covered

49.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_gopher.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http_deep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

8705

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http_deep.cc	1

Fuzzer: curl_fuzzer_ldap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1779	59.3%
gold	[1:9]	16	0.53%
yellow	[10:29]	19	0.63%
greenyellow	[30:49]	19	0.63%
lawngreen	50+	1164	38.8%
All colors	2997	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	367	formadd	call site: 00367	fuzz_set_easy_options
77	1766	mev_sh_entry_get	call site: 01766	mev_sh_entry_xfer_add
71	1035	curlx_nonblock	call site: 01035	wakeup_inet
59	1552	curl_getenv	call site: 01552	curlx_dyn_addf
46	2462	Curl_thrdq_trace	call site: 02462	Curl_thrdpool_trace
43	144	Curl_init_userdefined	call site: 00144	curl_mfprintf
43	2161	pgrsupdate	call site: 02161	timebuf
38	2263	Curl_bufq_len	call site: 02263	Curl_debug
33	635	curlx_strcopy	call site: 00635	append
29	296	Curl_bufref_memdup0	call site: 00296	Curl_bufref_memdup0
28	873	curlx_dyn_add	call site: 00873	url_sethost
27	1921	Curl_conn_terminate	call site: 01921	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4523

Functions that are reachable but not covered

642

Reachable functions

1287

Percentage of reachable functions covered

50.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ldap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	13
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	160
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	6
curl/lib/uint-bset.c	8
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	10
curl/lib/uint-spbset.c	11
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	23
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curltool_progress.c	11
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1555

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ftp.cc	1

Fuzzer: curl_fuzzer_proto_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

6004

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http.cc	1