High level conclusions

Fuzzer curl_fuzzer_proto_https_mbedtls is blocked:

The runtime code coverage of curl_fuzzer_proto_https_mbedtls covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_proto_https_gnutls is blocked:

The runtime code coverage of curl_fuzzer_proto_https_gnutls covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 13.68% of cyclomatic complexity.

Fuzzers reach 17.86% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1115 / 6241

Cyclomatic complexity statically reachable by fuzzers

4553 / 33279

Runtime code coverage of functions

2473 / 6241

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: curl_fuzzer_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1862	62.2%
gold	[1:9]	6	0.20%
yellow	[10:29]	19	0.63%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1093	36.5%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
41	2262	Curl_bufq_len	call site: 02262	Curl_debug
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
32	1649	mstate_connecting_pollset	call site: 01649	mstate_perform_pollset
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

2332

Functions that are reachable but not covered

699

Reachable functions

1307

Percentage of reachable functions covered

46.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_tftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_mqtt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1813	60.6%
gold	[1:9]	6	0.20%
yellow	[10:29]	26	0.86%
greenyellow	[30:49]	17	0.56%
lawngreen	50+	1127	37.7%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
27	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

2375

Functions that are reachable but not covered

672

Reachable functions

1307

Percentage of reachable functions covered

48.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_mqtt.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1903	63.6%
gold	[1:9]	20	0.66%
yellow	[10:29]	19	0.63%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1038	34.7%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
41	2262	Curl_bufq_len	call site: 02262	Curl_debug
40	2307	Curl_bufq_skip	call site: 02307	Curl_xfer_send_shutdown
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
32	1649	mstate_connecting_pollset	call site: 01649	mstate_perform_pollset
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

3806

Functions that are reachable but not covered

707

Reachable functions

1307

Percentage of reachable functions covered

45.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_https.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_multi

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

6714

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_multi.cc	1

Fuzzer: curl_fuzzer_smtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1754	58.6%
gold	[1:9]	21	0.70%
yellow	[10:29]	17	0.56%
greenyellow	[30:49]	6	0.20%
lawngreen	50+	1191	39.8%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

4005

Functions that are reachable but not covered

645

Reachable functions

1307

Percentage of reachable functions covered

50.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smtp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1764	59.0%
gold	[1:9]	12	0.40%
yellow	[10:29]	4	0.13%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1200	40.1%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add
25	2781	Curl_close	call site: 02781	share_unlink

Runtime coverage analysis

Covered functions

4562

Functions that are reachable but not covered

637

Reachable functions

1307

Percentage of reachable functions covered

51.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ws.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_imap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1745	58.3%
gold	[1:9]	22	0.73%
yellow	[10:29]	20	0.66%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1193	39.9%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

3976

Functions that are reachable but not covered

637

Reachable functions

1307

Percentage of reachable functions covered

51.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_imap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

7142

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_api.cc	1

Fuzzer: curl_fuzzer_proto_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

6311

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ws.cc	1

Fuzzer: curl_fuzzer_proto_https_gnutls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1165

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_gnutls.cc	1

Fuzzer: curl_fuzzer_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1949	65.2%
gold	[1:9]	26	0.86%
yellow	[10:29]	12	0.40%
greenyellow	[30:49]	58	1.94%
lawngreen	50+	944	31.5%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
114	1752	Curl_meta_set	call site: 01752	mev_pollset_diff
103	1524	Curl_xfer_recv_is_paused	call site: 01524	url_query
80	1021	wakeup_eventfd	call site: 01021	wakeup_inet
52	1412	cshutdn_run_conn_handler	call site: 01412	loghex
51	2907	curl_multi_perform	call site: 02907	curl_multi_perform
50	1962	cshutdn_perform	call site: 01962	Curl_conn_terminate
49	2251	prune_head	call site: 02251	xfer_send
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
42	2565	Curl_close	call site: 02565	Curl_async_destroy
35	2081	pgrsupdate	call site: 02081	timebuf

Runtime coverage analysis

Covered functions

1934

Functions that are reachable but not covered

790

Reachable functions

1307

Percentage of reachable functions covered

39.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_file.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

8963

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto.cc	1

Fuzzer: curl_fuzzer_pop3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1801	60.2%
gold	[1:9]	16	0.53%
yellow	[10:29]	18	0.60%
greenyellow	[30:49]	14	0.46%
lawngreen	50+	1140	38.1%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost

Runtime coverage analysis

Covered functions

4052

Functions that are reachable but not covered

650

Reachable functions

1307

Percentage of reachable functions covered

50.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_pop3.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https_mbedtls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	0	EP	call site: 00000

Runtime coverage analysis

Covered functions

1193

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_mbedtls.cc	1

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	65.1%
gold	[1:9]	1	0.26%
yellow	[10:29]	11	2.87%
greenyellow	[30:49]	2	0.52%
lawngreen	50+	119	31.1%
All colors	382	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
48	294	curl_url_cleanup	call site: 00294	url_sethost
38	254	Curl_urldecode	call site: 00254	checkurl
27	216	curlx_dyn_vprintf	call site: 00216	curl_mvaprintf
20	131	curl_mvsnprintf	call site: 00131	curl_url_get
18	110	formatf	call site: 00110	out_double
11	19	free_urlhandle	call site: 00019	curlx_strzero
8	153	urlget_url	call site: 00153	file_url
8	194	curlx_dyn_ptr	call site: 00194	curlx_dyn_addf
7	100	out_number	call site: 00100	stream_pad
6	36	Curl_get_scheme	call site: 00036	set_url_port
6	52	curl_url_set	call site: 00052	curl_url_set
6	77	parsefmt	call site: 00077

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

94

Reachable functions

166

Percentage of reachable functions covered

43.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_url.cc	7
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/tests/libtest/lib1560.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1829	61.1%
gold	[1:9]	3	0.10%
yellow	[10:29]	17	0.56%
greenyellow	[30:49]	18	0.60%
lawngreen	50+	1122	37.5%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost

Runtime coverage analysis

Covered functions

2366

Functions that are reachable but not covered

661

Reachable functions

1307

Percentage of reachable functions covered

49.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_dict.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: fuzz_bufq

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	468	88.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	11.8%
All colors	531	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
386	113	Curl_bufq_pass	call site: 00113	append
14	2	LLVMFuzzerTestOneInput	call site: 00002	allocate_template_buffer
12	99	bufq_slurpn	call site: 00099	Curl_bufq_pass
10	72	Curl_bufq_read	call site: 00072	Curl_bufq_slurp
10	504	Curl_bufq_skip	call site: 00504	Curl_bufq_write
8	59	chunk_peek_at	call site: 00059	Curl_bufq_read
7	49	chunk_peek	call site: 00049	Curl_bufq_peek_at
5	520	chunk_append	call site: 00520	Curl_bufq_free
4	27	Curl_bufq_init	call site: 00027	Curl_bufq_is_empty
4	35	Curl_bufq_len	call site: 00035	Curl_bufq_peek
2	24	bufq_init	call site: 00024	FV_PRINTF
2	32	Curl_bufq_is_empty	call site: 00032	Curl_bufq_len

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

24

Reachable functions

59

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_bufq.cc	32
curl/lib/bufq.c	29
curl/docs/examples/htmltitle.cpp	1
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/lib/mprintf.c	40
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: fuzz_doh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	34.6%
gold	[1:9]	39	15.1%
yellow	[10:29]	2	0.77%
greenyellow	[30:49]	2	0.77%
lawngreen	50+	125	48.6%
All colors	257	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	93	curl_mvsnprintf	call site: 00093	curl_msnprintf
11	79	out_string	call site: 00079	out_double
7	62	out_number	call site: 00062	stream_pad
6	20	str_num_base	call site: 00020	curlx_str_single
5	27	parsefmt	call site: 00027	dollarstring
5	55	formatf	call site: 00055	stream_pad
4	7	curl_easy_init	call site: 00007	curl_mfprintf
4	33	parsefmt	call site: 00033	is_arg_used
4	149	Curl_init_userdefined	call site: 00149	doh_resp_decode_httpsrr
3	2	LLVMFuzzerTestOneInput	call site: 00002	curl_easy_init
3	40	parsefmt	call site: 00040
3	47	parsefmt	call site: 00047	DEBUGASSERT

Runtime coverage analysis

Covered functions

568

Functions that are reachable but not covered

51

Reachable functions

103

Percentage of reachable functions covered

50.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_doh.cc	17
curl/lib/easy.c	6
curl/lib/mprintf.c	32
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/uint-hashset.c	1
curl/lib/curlx/dynbuf.c	6
curl/lib/bufref.c	1
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl/lib/vdns/doh.c	24
curl/lib/urlapi.c	1
curl/lib/vdns/httpsrr.c	5
curl/lib/connect.c	1
curl/lib/curlx/strdup.c	2

Fuzzer: curl_fuzzer_proto_h2_proxy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

9376

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_h2_proxy.cc	1

Fuzzer: curl_fuzzer_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1619	54.1%
gold	[1:9]	23	0.76%
yellow	[10:29]	14	0.46%
greenyellow	[30:49]	1	0.03%
lawngreen	50+	1332	44.5%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add
25	2781	Curl_close	call site: 02781	share_unlink

Runtime coverage analysis

Covered functions

4375

Functions that are reachable but not covered

589

Reachable functions

1307

Percentage of reachable functions covered

54.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

7071

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_timing.cc	1

Fuzzer: curl_fuzzer_proto_wss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

7091

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_wss.cc	1

Fuzzer: curl_fuzzer_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1827	61.1%
gold	[1:9]	11	0.36%
yellow	[10:29]	33	1.10%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	1114	37.2%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost

Runtime coverage analysis

Covered functions

3914

Functions that are reachable but not covered

659

Reachable functions

1307

Percentage of reachable functions covered

49.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_gopher.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http_deep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

8250

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http_deep.cc	1

Fuzzer: curl_fuzzer_proto_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

10602

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https.cc	1

Fuzzer: curl_fuzzer_proto_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

5268

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_tftp.cc	1

Fuzzer: curl_fuzzer_proto_telnet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

5273

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_telnet.cc	1

Fuzzer: curl_fuzzer_rtsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1739	58.1%
gold	[1:9]	5	0.16%
yellow	[10:29]	3	0.10%
greenyellow	[30:49]	12	0.40%
lawngreen	50+	1230	41.1%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add
25	2781	Curl_close	call site: 02781	share_unlink

Runtime coverage analysis

Covered functions

2593

Functions that are reachable but not covered

633

Reachable functions

1307

Percentage of reachable functions covered

51.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_rtsp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1655	55.3%
gold	[1:9]	26	0.86%
yellow	[10:29]	33	1.10%
greenyellow	[30:49]	25	0.83%
lawngreen	50+	1250	41.8%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
35	2081	pgrsupdate	call site: 02081	timebuf
33	642	curlx_strcopy	call site: 00642	append
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
25	2781	Curl_close	call site: 02781	share_unlink
23	1649	mstate_connecting_pollset	call site: 01649	mstate_protocol_pollset
22	1409	Curl_pgrsTime	call site: 01409	disconnect

Runtime coverage analysis

Covered functions

3160

Functions that are reachable but not covered

615

Reachable functions

1307

Percentage of reachable functions covered

52.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_http.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

5513

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ftp.cc	1

Fuzzer: curl_fuzzer_proto_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

6282

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http.cc	1

Fuzzer: curl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1619	54.1%
gold	[1:9]	44	1.47%
yellow	[10:29]	7	0.23%
greenyellow	[30:49]	11	0.36%
lawngreen	50+	1308	43.7%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
261	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
37	1030	curlx_nonblock	call site: 01030	wakeup_inet
35	2081	pgrsupdate	call site: 02081	timebuf
33	1068	Curl_poll	call site: 01068	Curl_poll
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost
26	1919	Curl_conn_terminate	call site: 01919	Curl_cshutdn_add
25	2781	Curl_close	call site: 02781	share_unlink

Runtime coverage analysis

Covered functions

4938

Functions that are reachable but not covered

579

Reachable functions

1307

Percentage of reachable functions covered

55.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ldap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1824	61.0%
gold	[1:9]	14	0.46%
yellow	[10:29]	20	0.66%
greenyellow	[30:49]	9	0.30%
lawngreen	50+	1122	37.5%
All colors	2989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	374	formadd	call site: 00374	fuzz_set_easy_options
81	1760	mev_sh_entry_get	call site: 01760	mev_sh_entry_xfer_add
71	1030	curlx_nonblock	call site: 01030	wakeup_inet
59	1546	curl_getenv	call site: 01546	curlx_dyn_addf
46	2455	Curl_thrdq_trace	call site: 02455	Curl_thrdpool_trace
43	151	Curl_init_userdefined	call site: 00151	curl_mfprintf
38	2262	Curl_bufq_len	call site: 02262	Curl_debug
35	2081	pgrsupdate	call site: 02081	timebuf
34	2313	req_flush	call site: 02313	Curl_xfer_send_shutdown
33	642	curlx_strcopy	call site: 00642	append
29	303	Curl_bufref_memdup0	call site: 00303	Curl_bufref_memdup0
28	879	curlx_dyn_add	call site: 00879	url_sethost

Runtime coverage analysis

Covered functions

4093

Functions that are reachable but not covered

656

Reachable functions

1307

Percentage of reachable functions covered

49.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ldap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	22
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	60
curl/lib/hash.c	17
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	50
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	55
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/connect.c	7
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	22
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4