High level conclusions

Fuzzer fuzz_netrc is blocked:

The runtime code coverage of fuzz_netrc covers 12.04% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 15.38% of cyclomatic complexity.

Fuzzers reach 19.83% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1269 / 6398

Cyclomatic complexity statically reachable by fuzzers

5218 / 33922

Runtime code coverage of functions

2802 / 6398

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: curl_fuzzer_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1848	61.0%
gold	[1:9]	10	0.33%
yellow	[10:29]	19	0.62%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1142	37.7%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
41	2300	Curl_bufq_len	call site: 02300	Curl_debug
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
32	1677	mstate_connecting_pollset	call site: 01677	mstate_perform_pollset
30	882	curlx_dyn_add	call site: 00882	url_sethost

Runtime coverage analysis

Covered functions

1091

Functions that are reachable but not covered

706

Reachable functions

1319

Percentage of reachable functions covered

46.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_tftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_imap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1730	57.1%
gold	[1:9]	13	0.42%
yellow	[10:29]	26	0.85%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1250	41.2%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	938	ipv6_parse	call site: 00938	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1336

Functions that are reachable but not covered

644

Reachable functions

1319

Percentage of reachable functions covered

51.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_imap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_smtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1740	57.4%
gold	[1:9]	18	0.59%
yellow	[10:29]	19	0.62%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1242	41.0%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	938	ipv6_parse	call site: 00938	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1343

Functions that are reachable but not covered

652

Reachable functions

1319

Percentage of reachable functions covered

50.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smtp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_resolver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6035	71.4%
gold	[1:9]	49	0.58%
yellow	[10:29]	31	0.36%
greenyellow	[30:49]	29	0.34%
lawngreen	50+	2297	27.2%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
665	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
240	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_readdir
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
212	4206	base64_encode	call site: 04206	ssh_state_sftp_quote
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
104	3267	url_set_data_creds	call site: 03267	curl_url_set
96	4108	multi_do	call site: 04108	myssh_multi_statemach
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1196

Functions that are reachable but not covered

1014

Reachable functions

1619

Percentage of reachable functions covered

37.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_resolver.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6311	74.7%
gold	[1:9]	39	0.46%
yellow	[10:29]	13	0.15%
greenyellow	[30:49]	9	0.10%
lawngreen	50+	2069	24.5%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
916	4513	curlx_str_octal	call site: 04513	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
179	6769	http_header_c	call site: 06769	http_header_p
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
104	3267	url_set_data_creds	call site: 03267	curl_url_set
95	4108	multi_do	call site: 04108	myssh_multi_statemach
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
86	3527	Curl_strntoupper	call site: 03527	parse_proxy

Runtime coverage analysis

Covered functions

1180

Functions that are reachable but not covered

1018

Reachable functions

1619

Percentage of reachable functions covered

37.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ws.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1745	57.6%
gold	[1:9]	12	0.39%
yellow	[10:29]	10	0.33%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	1256	41.4%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	938	ipv6_parse	call site: 00938	fuzz_handle_transfer
25	1963	Curl_cshutdn_terminate	call site: 01963	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

1525

Functions that are reachable but not covered

640

Reachable functions

1319

Percentage of reachable functions covered

51.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ws.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1811	59.8%
gold	[1:9]	21	0.69%
yellow	[10:29]	11	0.36%
greenyellow	[30:49]	7	0.23%
lawngreen	50+	1177	38.8%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
41	2300	Curl_bufq_len	call site: 02300	Curl_debug
40	2345	Curl_bufq_skip	call site: 02345	Curl_xfer_send_shutdown
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
32	1677	mstate_connecting_pollset	call site: 01677	mstate_perform_pollset

Runtime coverage analysis

Covered functions

1233

Functions that are reachable but not covered

696

Reachable functions

1319

Percentage of reachable functions covered

47.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_https.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5353	63.4%
gold	[1:9]	54	0.63%
yellow	[10:29]	50	0.59%
greenyellow	[30:49]	43	0.50%
lawngreen	50+	2941	34.8%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
186	8170	Curl_wakeup_signal	call site: 08170	proto_fuzzer::MultiSocketDriver::DriveReady
181	7245	curl_easy_perform	call site: 07245	curl_easy_perform
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1618

Functions that are reachable but not covered

882

Reachable functions

1619

Percentage of reachable functions covered

45.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_api.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_multi

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5404	64.0%
gold	[1:9]	17	0.20%
yellow	[10:29]	55	0.65%
greenyellow	[30:49]	72	0.85%
lawngreen	50+	2893	34.2%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
434	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
270	8170	Curl_wakeup_signal	call site: 08170	proto_fuzzer::MultiSocketDriver::DriveReady
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1535

Functions that are reachable but not covered

899

Reachable functions

1619

Percentage of reachable functions covered

44.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_multi.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5335	63.2%
gold	[1:9]	58	0.68%
yellow	[10:29]	82	0.97%
greenyellow	[30:49]	26	0.30%
lawngreen	50+	2940	34.8%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
98	7241	curl_multi_perform	call site: 07241	curl_easy_perform
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1737

Functions that are reachable but not covered

938

Reachable functions

1619

Percentage of reachable functions covered

42.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_mqtt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1800	59.4%
gold	[1:9]	7	0.23%
yellow	[10:29]	26	0.85%
greenyellow	[30:49]	68	2.24%
lawngreen	50+	1126	37.1%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
26	1963	Curl_cshutdn_terminate	call site: 01963	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

1135

Functions that are reachable but not covered

679

Reachable functions

1319

Percentage of reachable functions covered

48.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_mqtt.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1954	64.5%
gold	[1:9]	22	0.72%
yellow	[10:29]	17	0.56%
greenyellow	[30:49]	58	1.91%
lawngreen	50+	976	32.2%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
103	1552	Curl_xfer_recv_is_paused	call site: 01552	url_query
92	1778	Curl_meta_set	call site: 01778	mev_pollset_diff
80	1023	wakeup_eventfd	call site: 01023	wakeup_inet
59	2005	cshutdn_perform	call site: 02005	Curl_cshutdn_terminate
52	1441	cshutdn_run_conn_handler	call site: 01441	loghex
50	2944	curl_multi_perform	call site: 02944	curl_multi_perform
49	2289	prune_head	call site: 02289	xfer_send
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
42	2603	Curl_close	call site: 02603	Curl_async_destroy
36	1875	Curl_uint32_tbl_remove	call site: 01875	Curl_uint32_spbset_next

Runtime coverage analysis

Covered functions

779

Functions that are reachable but not covered

794

Reachable functions

1319

Percentage of reachable functions covered

39.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_file.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	255	66.0%
gold	[1:9]	1	0.25%
yellow	[10:29]	11	2.84%
greenyellow	[30:49]	5	1.29%
lawngreen	50+	114	29.5%
All colors	386	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	298	curl_url_cleanup	call site: 00298	url_sethost
42	254	Curl_urldecode	call site: 00254	checkurl
27	216	curlx_dyn_vprintf	call site: 00216	curl_mvaprintf
20	131	curl_mvsnprintf	call site: 00131	curl_url_get
18	110	formatf	call site: 00110	out_double
11	19	free_urlhandle	call site: 00019	curlx_strzero
8	153	urlget_url	call site: 00153	file_url
8	194	curlx_dyn_ptr	call site: 00194	curlx_dyn_addf
7	100	out_number	call site: 00100	stream_pad
7	376	ipv6_parse	call site: 00376	hostname_check6
6	36	Curl_get_scheme	call site: 00036	set_url_port
6	52	curl_url_set	call site: 00052	curl_url_set

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

95

Reachable functions

166

Percentage of reachable functions covered

42.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_url.cc	7
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/tests/libtest/lib1560.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_pop3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1784	58.9%
gold	[1:9]	25	0.82%
yellow	[10:29]	13	0.42%
greenyellow	[30:49]	4	0.13%
lawngreen	50+	1201	39.6%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1279

Functions that are reachable but not covered

656

Reachable functions

1319

Percentage of reachable functions covered

50.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_pop3.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_h2_proxy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6074	71.9%
gold	[1:9]	58	0.68%
yellow	[10:29]	54	0.63%
greenyellow	[30:49]	16	0.18%
lawngreen	50+	2239	26.5%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1448

Functions that are reachable but not covered

999

Reachable functions

1619

Percentage of reachable functions covered

38.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_h2_proxy.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1813	59.8%
gold	[1:9]	10	0.33%
yellow	[10:29]	18	0.59%
greenyellow	[30:49]	15	0.49%
lawngreen	50+	1171	38.6%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1125

Functions that are reachable but not covered

668

Reachable functions

1319

Percentage of reachable functions covered

49.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_dict.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1538	50.8%
gold	[1:9]	14	0.46%
yellow	[10:29]	59	1.94%
greenyellow	[30:49]	18	0.59%
lawngreen	50+	1398	46.1%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	2820	Curl_close	call site: 02820	share_unlink
22	1875	Curl_uint32_tbl_remove	call site: 01875	Curl_uint32_spbset_next

Runtime coverage analysis

Covered functions

1805

Functions that are reachable but not covered

585

Reachable functions

1319

Percentage of reachable functions covered

55.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https_gnutls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5595	66.2%
gold	[1:9]	51	0.60%
yellow	[10:29]	35	0.41%
greenyellow	[30:49]	22	0.26%
lawngreen	50+	2738	32.4%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
99	7241	curl_multi_perform	call site: 07241	curl_easy_perform
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1687

Functions that are reachable but not covered

975

Reachable functions

1619

Percentage of reachable functions covered

39.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_gnutls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_https_h2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5902	69.9%
gold	[1:9]	83	0.98%
yellow	[10:29]	37	0.43%
greenyellow	[30:49]	23	0.27%
lawngreen	50+	2396	28.3%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
95	4108	multi_do	call site: 04108	myssh_multi_statemach
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1562

Functions that are reachable but not covered

981

Reachable functions

1619

Percentage of reachable functions covered

39.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_h2.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_https_mbedtls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5580	66.1%
gold	[1:9]	51	0.60%
yellow	[10:29]	56	0.66%
greenyellow	[30:49]	22	0.26%
lawngreen	50+	2732	32.3%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
99	7241	curl_multi_perform	call site: 07241	curl_easy_perform
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1666

Functions that are reachable but not covered

971

Reachable functions

1619

Percentage of reachable functions covered

40.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_mbedtls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: fuzz_netrc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2078	88.9%
gold	[1:9]	3	0.12%
yellow	[10:29]	2	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	252	10.7%
All colors	2335	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
856	590	curl_easy_cleanup	call site: 00590	Curl_async_shutdown
297	1722	Curl_close	call site: 01722	curl_multi_cleanup
195	1449	Curl_llist_head	call site: 01449	Curl_conn_close
152	1	LLVMFuzzerTestOneInput	call site: 00001	append
118	194	curlx_dyn_ptr	call site: 00194	curlx_dyn_addf
89	2095	Curl_share_lock	call site: 02095	cookie_output
78	318	curlx_dyn_add	call site: 00318	curl_url_set
47	1674	sigpipe_restore	call site: 01674	Curl_cshutdn_terminate
42	2023	Curl_close	call site: 02023	Curl_async_destroy
25	2263	Curl_close	call site: 02263	share_unlink
24	2216	Curl_close	call site: 02216	Curl_fopen
22	1651	Curl_hash_destroy	call site: 01651	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

650

Reachable functions

739

Percentage of reachable functions covered

12.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_netrc.cc	17
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	5
curl/lib/mprintf.c	40
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	3
curl/lib/curlx/dynbuf.c	16
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2
curl/lib/easy.c	21
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	3
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	2
curl/lib/creds.c	7
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/sigpipe.h	4
curl/lib/multi.c	116
curl/lib/vdns/hostip.c	2
curl/tests/libtest/lib2453.c	2
curl/lib/uint-bset.c	5
curl/lib/progress.c	20
curltool_progress.c	11
curl/lib/curlx/timeval.c	7
curl/lib/transfer.c	16
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ratelimit.c	6
curl/lib/cfilters.c	18
curl/lib/ws.c	2
curl/lib/uint-table.c	7
curl/lib/bufq.c	11
curl/lib/curl_trc.c	15
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/cshutdn.c	56
curl/lib/splay.c	6
curl/lib/conncache.c	40
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/multi_ev.c	53
curl/lib/select.c	24
curl/tests/unit/unit2606.c	1
curl/lib/http.c	6
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/uint-spbset.c	14
curl/lib/ftplistparser.c	5
curl/lib/llist.c	7
curl/lib/connect.c	2
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/winapi.c	4
curl/lib/peer.c	2
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/cli_ev_download.c	1
curl/lib/vdns/asyn-thrdd.c	8
curl/lib/thrdqueue.c	19
curl/lib/thrdpool.c	23
curl/lib/curl_threads.c	5
curl/lib/curlx/wait.c	5
curl/lib/vdns/dnscache.c	1
curl/lib/psl.c	2
curl/lib/vtls/vtls_scache.c	7
curl/lib/multi_ntfy.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/slist.c	2
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4
curl/lib/mime.c	8

Fuzzer: fuzz_bufq

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	472	88.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	11.7%
All colors	535	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
390	113	Curl_bufq_pass	call site: 00113	append
14	2	LLVMFuzzerTestOneInput	call site: 00002	allocate_template_buffer
12	99	bufq_slurpn	call site: 00099	Curl_bufq_pass
10	72	Curl_bufq_read	call site: 00072	Curl_bufq_slurp
10	508	Curl_bufq_skip	call site: 00508	Curl_bufq_write
8	59	chunk_peek_at	call site: 00059	Curl_bufq_read
7	49	chunk_peek	call site: 00049	Curl_bufq_peek_at
5	524	chunk_append	call site: 00524	Curl_bufq_free
4	27	Curl_bufq_init	call site: 00027	Curl_bufq_is_empty
4	35	Curl_bufq_len	call site: 00035	Curl_bufq_peek
2	24	bufq_init	call site: 00024	FV_PRINTF
2	32	Curl_bufq_is_empty	call site: 00032	Curl_bufq_len

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

24

Reachable functions

59

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_bufq.cc	32
curl/lib/bufq.c	29
curl/docs/examples/htmltitle.cpp	1
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/lib/mprintf.c	40
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_proto_socks4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5963	70.6%
gold	[1:9]	56	0.66%
yellow	[10:29]	44	0.52%
greenyellow	[30:49]	30	0.35%
lawngreen	50+	2348	27.8%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
665	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
240	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_readdir
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
212	4206	base64_encode	call site: 04206	ssh_state_sftp_quote
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
104	3267	url_set_data_creds	call site: 03267	curl_url_set
96	4108	multi_do	call site: 04108	myssh_multi_statemach
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
81	761	mev_sh_entry_get	call site: 00761	mev_forget_socket

Runtime coverage analysis

Covered functions

1275

Functions that are reachable but not covered

993

Reachable functions

1619

Percentage of reachable functions covered

38.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_socks4.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: fuzz_doh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	34.9%
gold	[1:9]	38	14.9%
yellow	[10:29]	1	0.39%
greenyellow	[30:49]	1	0.39%
lawngreen	50+	126	49.4%
All colors	255	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	93	curl_mvsnprintf	call site: 00093	curl_msnprintf
11	79	out_string	call site: 00079	out_double
7	62	out_number	call site: 00062	stream_pad
6	20	str_num_base	call site: 00020	curlx_str_single
5	27	parsefmt	call site: 00027	dollarstring
5	55	formatf	call site: 00055	stream_pad
4	7	curl_easy_init	call site: 00007	curl_mfprintf
4	33	parsefmt	call site: 00033	is_arg_used
4	148	Curl_init_userdefined	call site: 00148	doh_resp_decode_httpsrr
3	2	LLVMFuzzerTestOneInput	call site: 00002	curl_easy_init
3	40	parsefmt	call site: 00040
3	47	parsefmt	call site: 00047	DEBUGASSERT

Runtime coverage analysis

Covered functions

143

Functions that are reachable but not covered

51

Reachable functions

103

Percentage of reachable functions covered

50.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_doh.cc	17
curl/lib/easy.c	6
curl/lib/mprintf.c	32
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/uint-hashset.c	1
curl/lib/curlx/dynbuf.c	6
curl/lib/bufref.c	1
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl/lib/vdns/doh.c	24
curl/lib/vdns/httpsrr.c	5
curl/lib/connect.c	1
curl/lib/curlx/strdup.c	2

Fuzzer: curl_fuzzer_proto_http3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6092	72.1%
gold	[1:9]	139	1.64%
yellow	[10:29]	36	0.42%
greenyellow	[30:49]	26	0.30%
lawngreen	50+	2148	25.4%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
779	4650	curlx_sotouz	call site: 04650	myssh_multi_statemach
709	7197	curl_multi_info_read	call site: 07197	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
209	4440	curlx_str_word	call site: 04440	ssh_state_sftp_quote_statvfs
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
104	3267	url_set_data_creds	call site: 03267	curl_url_set
95	4108	multi_do	call site: 04108	myssh_multi_statemach
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
86	3527	Curl_strntoupper	call site: 03527	parse_proxy

Runtime coverage analysis

Covered functions

1518

Functions that are reachable but not covered

964

Reachable functions

1619

Percentage of reachable functions covered

40.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http3.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6556	77.6%
gold	[1:9]	19	0.22%
yellow	[10:29]	16	0.18%
greenyellow	[30:49]	12	0.14%
lawngreen	50+	1838	21.7%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
661	4768	Curl_xfer_setup_recv	call site: 04768	myssh_multi_statemach
618	6428	Curl_conn_cf_connect	call site: 06428	http_rw_hd
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
327	4440	curlx_str_word	call site: 04440	ssh_state_sftp_readdir
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
104	3267	url_set_data_creds	call site: 03267	curl_url_set
95	4108	multi_do	call site: 04108	myssh_multi_statemach
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1095

Functions that are reachable but not covered

1050

Reachable functions

1619

Percentage of reachable functions covered

35.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_gopher.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_rtsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1724	56.9%
gold	[1:9]	3	0.09%
yellow	[10:29]	7	0.23%
greenyellow	[30:49]	5	0.16%
lawngreen	50+	1288	42.5%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	938	ipv6_parse	call site: 00938	fuzz_handle_transfer
25	1963	Curl_cshutdn_terminate	call site: 01963	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

1324

Functions that are reachable but not covered

640

Reachable functions

1319

Percentage of reachable functions covered

51.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_rtsp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1811	59.8%
gold	[1:9]	14	0.46%
yellow	[10:29]	20	0.66%
greenyellow	[30:49]	10	0.33%
lawngreen	50+	1172	38.7%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
33	1070	Curl_poll	call site: 01070	Curl_poll
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1195

Functions that are reachable but not covered

666

Reachable functions

1319

Percentage of reachable functions covered

49.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_gopher.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http_deep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5328	63.1%
gold	[1:9]	82	0.97%
yellow	[10:29]	50	0.59%
greenyellow	[30:49]	30	0.35%
lawngreen	50+	2951	34.9%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
99	7241	curl_multi_perform	call site: 07241	curl_easy_perform
95	4108	multi_do	call site: 04108	myssh_multi_statemach
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1685

Functions that are reachable but not covered

946

Reachable functions

1619

Percentage of reachable functions covered

41.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http_deep.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1624	53.6%
gold	[1:9]	19	0.62%
yellow	[10:29]	16	0.52%
greenyellow	[30:49]	20	0.66%
lawngreen	50+	1348	44.5%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
35	2123	pgrsupdate	call site: 02123	timebuf
33	641	curlx_strcopy	call site: 00641	append
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	2820	Curl_close	call site: 02820	share_unlink
23	1677	mstate_connecting_pollset	call site: 01677	mstate_protocol_pollset
22	1438	Curl_pgrsTime	call site: 01438	disconnect

Runtime coverage analysis

Covered functions

1524

Functions that are reachable but not covered

621

Reachable functions

1319

Percentage of reachable functions covered

52.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_http.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5692	67.4%
gold	[1:9]	57	0.67%
yellow	[10:29]	43	0.50%
greenyellow	[30:49]	43	0.50%
lawngreen	50+	2606	30.8%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1530

Functions that are reachable but not covered

966

Reachable functions

1619

Percentage of reachable functions covered

40.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_timing.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_wss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6794	80.4%
gold	[1:9]	32	0.37%
yellow	[10:29]	17	0.20%
greenyellow	[30:49]	12	0.14%
lawngreen	50+	1586	18.7%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1789	4513	curlx_str_octal	call site: 04513	smtp_pp_statemachine
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
663	6456	Curl_cwriter_add	call site: 06456	http_rw_hd
361	4078	multistate_connecting	call site: 04078	myssh_multi_statemach
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
104	3267	url_set_data_creds	call site: 03267	curl_url_set
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
81	761	mev_sh_entry_get	call site: 00761	mev_forget_socket
72	4440	curlx_str_word	call site: 04440	Curl_get_pathname
70	1102	curlx_nonblock	call site: 01102	wakeup_inet
70	2625	cookie_tailmatch	call site: 02625	datenum

Runtime coverage analysis

Covered functions

924

Functions that are reachable but not covered

1111

Reachable functions

1619

Percentage of reachable functions covered

31.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_wss.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_telnet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6783	80.3%
gold	[1:9]	19	0.22%
yellow	[10:29]	15	0.17%
greenyellow	[30:49]	6	0.07%
lawngreen	50+	1618	19.1%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
916	4513	curlx_str_octal	call site: 04513	myssh_multi_statemach
687	6428	Curl_conn_cf_connect	call site: 06428	http_rw_hd
665	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
310	4108	multi_do	call site: 04108	myssh_multi_statemach
280	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
104	3267	url_set_data_creds	call site: 03267	curl_url_set
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
87	2615	Curl_host_is_ipnum	call site: 02615	datenum
81	761	mev_sh_entry_get	call site: 00761	mev_forget_socket
72	4440	curlx_str_word	call site: 04440	Curl_get_pathname

Runtime coverage analysis

Covered functions

851

Functions that are reachable but not covered

1091

Reachable functions

1619

Percentage of reachable functions covered

32.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_telnet.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5577	66.0%
gold	[1:9]	74	0.87%
yellow	[10:29]	18	0.21%
greenyellow	[30:49]	11	0.13%
lawngreen	50+	2761	32.7%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
358	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
283	5951	Curl_HMAC_final	call site: 05951	multistate_doing_more
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
149	4269	curlx_uztoui	call site: 04269	ssh_state_sftp_quote
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
102	6801	authcmp	call site: 06801	auth_spnego
99	7241	curl_multi_perform	call site: 07241	curl_easy_perform
95	4108	multi_do	call site: 04108	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1702

Functions that are reachable but not covered

969

Reachable functions

1619

Percentage of reachable functions covered

40.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_proto_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6843	81.0%
gold	[1:9]	66	0.78%
yellow	[10:29]	56	0.66%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1476	17.4%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
987	4440	curlx_str_word	call site: 04440	myssh_multi_statemach
697	5526	Curl_pgrsCheck	call site: 05526	smtp_pp_statemachine
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
622	6493	Curl_creader_set_fread	call site: 06493	http_rw_hd
310	4108	multi_do	call site: 04108	myssh_multi_statemach
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
104	3267	url_set_data_creds	call site: 03267	curl_url_set
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
87	2615	Curl_host_is_ipnum	call site: 02615	datenum
81	761	mev_sh_entry_get	call site: 00761	mev_forget_socket
67	5428	multistate_do	call site: 05428	Curl_http_follow

Runtime coverage analysis

Covered functions

874

Functions that are reachable but not covered

1086

Reachable functions

1619

Percentage of reachable functions covered

32.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_tftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer_ldap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1804	59.5%
gold	[1:9]	24	0.79%
yellow	[10:29]	16	0.52%
greenyellow	[30:49]	57	1.88%
lawngreen	50+	1126	37.1%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
71	1032	curlx_nonblock	call site: 01032	wakeup_inet
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
38	2300	Curl_bufq_len	call site: 02300	Curl_debug
35	2123	pgrsupdate	call site: 02123	timebuf
34	2351	req_flush	call site: 02351	Curl_xfer_send_shutdown
33	641	curlx_strcopy	call site: 00641	append
30	882	curlx_dyn_add	call site: 00882	url_sethost
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1222

Functions that are reachable but not covered

662

Reachable functions

1319

Percentage of reachable functions covered

49.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ldap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6408	75.9%
gold	[1:9]	25	0.29%
yellow	[10:29]	9	0.10%
greenyellow	[30:49]	14	0.16%
lawngreen	50+	1985	23.5%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
665	7241	curl_multi_perform	call site: 07241	proto_fuzzer::RunScenario
657	4768	Curl_xfer_setup_recv	call site: 04768	myssh_multi_statemach
631	5592	Curl_pp_readresp	call site: 05592	smtp_state_auth_resp
503	6543	Curl_req_done_sending	call site: 06543	http_rw_hd
310	4108	multi_do	call site: 04108	myssh_multi_statemach
239	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
209	4440	curlx_str_word	call site: 04440	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
94	4659	Curl_xfer_setup_send	call site: 04659	ssh_state_sftp_readdir
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy
90	8063	curl_multi_remove_handle	call site: 08063	proto_fuzzer::MultiSocketDriver::Start
81	761	mev_sh_entry_get	call site: 00761	mev_forget_socket

Runtime coverage analysis

Covered functions

1136

Functions that are reachable but not covered

1015

Reachable functions

1619

Percentage of reachable functions covered

37.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13

Fuzzer: curl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1563	51.6%
gold	[1:9]	35	1.15%
yellow	[10:29]	9	0.29%
greenyellow	[30:49]	6	0.19%
lawngreen	50+	1414	46.7%
All colors	3027	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
261	373	formadd	call site: 00373	fuzz_set_easy_options
81	1785	mev_sh_entry_get	call site: 01785	mev_forget_socket
59	1574	curl_getenv	call site: 01574	curlx_dyn_addf
46	2493	Curl_thrdq_trace	call site: 02493	Curl_thrdpool_trace
43	150	Curl_init_userdefined	call site: 00150	curl_mfprintf
37	1032	curlx_nonblock	call site: 01032	wakeup_inet
35	2123	pgrsupdate	call site: 02123	timebuf
33	1070	Curl_poll	call site: 01070	Curl_poll
29	302	Curl_bufref_memdup0	call site: 00302	Curl_bufref_memdup0
25	1963	Curl_cshutdn_terminate	call site: 01963	Curl_cshutdn_add
25	2820	Curl_close	call site: 02820	share_unlink
22	1875	Curl_uint32_tbl_remove	call site: 01875	Curl_uint32_spbset_next

Runtime coverage analysis

Covered functions

2097

Functions that are reachable but not covered

587

Reachable functions

1319

Percentage of reachable functions covered

55.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	20
curl/lib/uint-hashset.c	5
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	60
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	155
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	2
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	59
curl/lib/conncache.c	41
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	29
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	24
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	27
curl/lib/thrdpool.c	34
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	2
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	18
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/uint-spbset.c	14
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	15
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5999	71.0%
gold	[1:9]	47	0.55%
yellow	[10:29]	29	0.34%
greenyellow	[30:49]	16	0.18%
lawngreen	50+	2350	27.8%
All colors	8441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4755	curlx_str_numblanks	call site: 04755	myssh_multi_statemach
665	5569	Curl_conn_recv	call site: 05569	smtp_state_auth_resp
475	7431	header_has_value	call site: 07431	proto_fuzzer::RunScenario
280	8160	curl_multi_get_handles	call site: 08160	proto_fuzzer::MultiSocketDriver::DriveReady
212	4206	base64_encode	call site: 04206	ssh_state_sftp_quote
185	7241	curl_multi_perform	call site: 07241	curl_easy_perform
149	6793	http_header_p	call site: 06793	Curl_http_input_auth
136	4513	curlx_str_octal	call site: 04513	ssh_state_sftp_quote_statvfs
104	3267	url_set_data_creds	call site: 03267	curl_url_set
103	4650	curlx_sotouz	call site: 04650	ssh_state_sftp_readdir
95	4108	multi_do	call site: 04108	myssh_multi_statemach
93	3520	Curl_proxy_init_conn	call site: 03520	parse_proxy

Runtime coverage analysis

Covered functions

1232

Functions that are reachable but not covered

1019

Reachable functions

1619

Percentage of reachable functions covered

37.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	7
curl_fuzzer/proto_fuzzer/target_policy.cc	221
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	66
curl/lib/multi.c	258
curl/lib/conncache.c	61
curl/lib/url.c	150
curl/lib/llist.c	7
curl/lib/hash.c	20
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	60
curl/lib/connect.c	48
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	40
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	26
curl/lib/multi_ev.c	58
curl/lib/select.c	26
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	88
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	157
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/uint-spbset.c	14
curl/lib/uint-table.c	9
curl/lib/peer.c	34
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/uint-hashset.c	5
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	42
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	31
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	20
curl/lib/thrdqueue.c	29
curl/lib/thrdpool.c	34
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	27
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	26
curl/lib/curl_trc.c	25
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	64
curl/lib/cookie.c	96
curl/lib/curl_share.c	22
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	8
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	24
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	28
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/uint-hash.c	8
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl_fuzzer/proto_fuzzer/option_apply.cc	35
curl_fuzzer/proto_fuzzer/scenario_runner.cc	71
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	66
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/mock_server_base.cc	1
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	10
curl/lib/headers.c	13