High level conclusions

Fuzzer fuzz_netrc is blocked:

The runtime code coverage of fuzz_netrc covers 11.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_full_coverage is blocked:

The runtime code coverage of curl_fuzzer_full_coverage covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 15.89% of cyclomatic complexity.

Fuzzers reach 20.29% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1368 / 6740

Cyclomatic complexity statically reachable by fuzzers

5592 / 35174

Runtime code coverage of functions

2867 / 6740

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: curl_fuzzer_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1822	59.5%
gold	[1:9]	12	0.39%
yellow	[10:29]	16	0.52%
greenyellow	[30:49]	13	0.42%
lawngreen	50+	1195	39.0%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
71	1072	curlx_nonblock	call site: 01072	wakeup_inet
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2328	Curl_bufq_len	call site: 02328	Curl_debug
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
32	1727	mstate_connecting_pollset	call site: 01727	mstate_perform_pollset
30	889	curlx_dyn_add	call site: 00889	url_sethost

Runtime coverage analysis

Covered functions

1100

Functions that are reachable but not covered

707

Reachable functions

1330

Percentage of reachable functions covered

46.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_tftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_imap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1700	55.5%
gold	[1:9]	11	0.35%
yellow	[10:29]	17	0.55%
greenyellow	[30:49]	21	0.68%
lawngreen	50+	1309	42.8%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1367

Functions that are reachable but not covered

642

Reachable functions

1330

Percentage of reachable functions covered

51.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_imap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1929	63.0%
gold	[1:9]	24	0.78%
yellow	[10:29]	15	0.49%
greenyellow	[30:49]	58	1.89%
lawngreen	50+	1032	33.7%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
103	1602	Curl_xfer_recv_is_paused	call site: 01602	url_query
82	1061	wakeup_eventfd	call site: 01061	wakeup_inet
55	2060	cshutdn_perform	call site: 02060	Curl_cshutdn_terminate
52	1494	cshutdn_run_conn_handler	call site: 01494	loghex
50	2317	prune_head	call site: 02317	xfer_send
49	2976	curl_multi_perform	call site: 02976	curl_multi_perform
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2638	Curl_close	call site: 02638	Curl_async_destroy
38	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
38	1904	Curl_multi_get_easy	call site: 01904	Curl_uint32_spbset_next
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

783

Functions that are reachable but not covered

794

Reachable functions

1330

Percentage of reachable functions covered

40.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_file.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6516	73.0%
gold	[1:9]	63	0.70%
yellow	[10:29]	32	0.35%
greenyellow	[30:49]	46	0.51%
lawngreen	50+	2269	25.4%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
988	4536	curlx_str_word	call site: 04536	multi_done
514	7956	curl_ws_send	call site: 07956	proto_fuzzer::RunScenario
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
212	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
205	7641	header_has_value	call site: 07641	fuzz_initialize_fuzz_data
179	6868	http_header_c	call site: 06868	http_header_p
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
110	2648	cookie_tailmatch	call site: 02648	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1295

Functions that are reachable but not covered

1085

Reachable functions

1692

Percentage of reachable functions covered

35.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ws.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_smtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1708	55.8%
gold	[1:9]	11	0.35%
yellow	[10:29]	23	0.75%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1308	42.7%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1375

Functions that are reachable but not covered

650

Reachable functions

1330

Percentage of reachable functions covered

51.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smtp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_resolver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6268	70.2%
gold	[1:9]	129	1.44%
yellow	[10:29]	56	0.62%
greenyellow	[30:49]	47	0.52%
lawngreen	50+	2426	27.1%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
665	5679	Curl_conn_recv	call site: 05679	multistate_doing_more
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
212	4302	base64_encode	call site: 04302	ssh_state_sftp_quote
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
96	4204	multi_do	call site: 04204	myssh_multi_statemach
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1295

Functions that are reachable but not covered

1078

Reachable functions

1692

Percentage of reachable functions covered

36.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_resolver.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_multi

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5673	63.5%
gold	[1:9]	37	0.41%
yellow	[10:29]	82	0.91%
greenyellow	[30:49]	51	0.57%
lawngreen	50+	3083	34.5%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
746	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
265	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1639

Functions that are reachable but not covered

970

Reachable functions

1692

Percentage of reachable functions covered

42.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_multi.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1785	58.3%
gold	[1:9]	20	0.65%
yellow	[10:29]	15	0.49%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1230	40.2%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2328	Curl_bufq_len	call site: 02328	Curl_debug
40	2374	Curl_bufq_skip	call site: 02374	Curl_xfer_send_shutdown
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
36	2175	pgrsupdate	call site: 02175	timebuf
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
32	1727	mstate_connecting_pollset	call site: 01727	mstate_perform_pollset

Runtime coverage analysis

Covered functions

1271

Functions that are reachable but not covered

692

Reachable functions

1330

Percentage of reachable functions covered

47.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_https.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5572	62.4%
gold	[1:9]	113	1.26%
yellow	[10:29]	77	0.86%
greenyellow	[30:49]	62	0.69%
lawngreen	50+	3102	34.7%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4850	curlx_str_numblanks	call site: 04850	multi_done
555	7915	Curl_senddata	call site: 07915	proto_fuzzer::RunScenario
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
293	7343	curl_easy_perform	call site: 07343	curl_easy_perform
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
269	7641	header_has_value	call site: 07641	fuzz_initialize_fuzz_data
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
170	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1776

Functions that are reachable but not covered

953

Reachable functions

1692

Percentage of reachable functions covered

43.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_api.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1654	54.0%
gold	[1:9]	7	0.22%
yellow	[10:29]	15	0.49%
greenyellow	[30:49]	6	0.19%
lawngreen	50+	1376	44.9%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1664

Functions that are reachable but not covered

613

Reachable functions

1330

Percentage of reachable functions covered

53.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ws.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https_gnutls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5852	65.5%
gold	[1:9]	98	1.09%
yellow	[10:29]	59	0.66%
greenyellow	[30:49]	41	0.45%
lawngreen	50+	2876	32.2%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
208	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1875

Functions that are reachable but not covered

1035

Reachable functions

1692

Percentage of reachable functions covered

38.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_gnutls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_mqtt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1772	57.9%
gold	[1:9]	12	0.39%
yellow	[10:29]	25	0.81%
greenyellow	[30:49]	17	0.55%
lawngreen	50+	1232	40.2%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
71	1072	curlx_nonblock	call site: 01072	wakeup_inet
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1144

Functions that are reachable but not covered

678

Reachable functions

1330

Percentage of reachable functions covered

49.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_mqtt.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5459	61.1%
gold	[1:9]	106	1.18%
yellow	[10:29]	105	1.17%
greenyellow	[30:49]	37	0.41%
lawngreen	50+	3219	36.0%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4850	curlx_str_numblanks	call site: 04850	multi_done
514	7956	curl_ws_send	call site: 07956	proto_fuzzer::RunScenario
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
212	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
207	7339	curl_multi_perform	call site: 07339	curl_easy_perform
205	7641	header_has_value	call site: 07641	fuzz_initialize_fuzz_data
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego

Runtime coverage analysis

Covered functions

1893

Functions that are reachable but not covered

998

Reachable functions

1692

Percentage of reachable functions covered

41.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_https_h2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6125	68.6%
gold	[1:9]	100	1.12%
yellow	[10:29]	54	0.60%
greenyellow	[30:49]	19	0.21%
lawngreen	50+	2628	29.4%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
208	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1826

Functions that are reachable but not covered

1037

Reachable functions

1692

Percentage of reachable functions covered

38.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_h2.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	268	64.1%
gold	[1:9]	1	0.23%
yellow	[10:29]	11	2.63%
greenyellow	[30:49]	3	0.71%
lawngreen	50+	135	32.2%
All colors	418	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	302	curl_url_cleanup	call site: 00302	url_sethost
42	258	Curl_urldecode	call site: 00258	checkurl
28	219	curlx_dyn_vprintf	call site: 00219	curl_mvaprintf
20	134	curl_mvsnprintf	call site: 00134	curl_url_get
19	112	formatf	call site: 00112	out_double
12	403	ipv4_normalize	call site: 00403	ipv4_normalize
11	19	free_urlhandle	call site: 00019	curlx_strzero
8	156	urlget_url	call site: 00156	file_url
8	197	curlx_dyn_ptr	call site: 00197	curlx_dyn_addf
7	53	curl_url_set	call site: 00053	curl_url_set
7	102	out_number	call site: 00102	stream_pad
6	36	Curl_get_scheme	call site: 00036	set_url_port

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

96

Reachable functions

167

Percentage of reachable functions covered

42.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_url.cc	7
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/tests/libtest/lib1560.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1785	58.3%
gold	[1:9]	7	0.22%
yellow	[10:29]	26	0.85%
greenyellow	[30:49]	12	0.39%
lawngreen	50+	1228	40.1%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1133

Functions that are reachable but not covered

667

Reachable functions

1330

Percentage of reachable functions covered

49.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_dict.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_pop3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1754	57.3%
gold	[1:9]	16	0.52%
yellow	[10:29]	18	0.58%
greenyellow	[30:49]	59	1.92%
lawngreen	50+	1211	39.6%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1315

Functions that are reachable but not covered

654

Reachable functions

1330

Percentage of reachable functions covered

50.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_pop3.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_full_coverage

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1440	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1440	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1439	0	EP	call site: 00000	full_coverage::ExerciseUtilityApiCoverage

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

1284

Reachable functions

1284

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_full_coverage.cc	6
curl_fuzzer/full_coverage/public_api.cc	25
curl/lib/easy.c	14
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/escape.c	12
curl/lib/curlx/dynbuf.c	14
curl/lib/formdata.c	45
curl/lib/bufref.c	6
curl/lib/curlx/strdup.c	5
curl/lib/mime.c	59
curl/lib/strequal.c	3
curl/lib/slist.c	6
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	2
curl/lib/curlx/timeval.c	2
curl/lib/curlx/basename.c	1
curl/lib/curlx/warnless.c	1
curl/tests/libtest/lib553.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	3
curl/lib/vquic/vquic.c	3
curl/lib/amigaos.c	2
curl_fuzzer/full_coverage/utility_api.cc	13
curl/lib/version.c	22
curl/lib/vtls/vtls.c	4
curl/lib/http2.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/lib/openldap.c	4
curl/lib/parsedate.c	25
curl_fuzzer/full_coverage/dynamic_formatting.cc	7
curl_fuzzer/full_coverage/legacy_mutator.cc	26
curl/lib/splay.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/u8_strset.c	2
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl_fuzzer/legacy_tlv_mutator.cc	60
curl_fuzzer/tests/full_coverage_mutator_test.cc	3
curltool_paramhlp.c	3

Fuzzer: curl_fuzzer_proto_https_mbedtls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5851	65.5%
gold	[1:9]	85	0.95%
yellow	[10:29]	57	0.63%
greenyellow	[30:49]	56	0.62%
lawngreen	50+	2877	32.2%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
208	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1848

Functions that are reachable but not covered

1032

Reachable functions

1692

Percentage of reachable functions covered

39.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_mbedtls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_h2_proxy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6375	71.4%
gold	[1:9]	92	1.03%
yellow	[10:29]	74	0.82%
greenyellow	[30:49]	44	0.49%
lawngreen	50+	2341	26.2%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
110	2648	cookie_tailmatch	call site: 02648	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1624

Functions that are reachable but not covered

1064

Reachable functions

1692

Percentage of reachable functions covered

37.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_h2_proxy.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_netrc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2091	88.8%
gold	[1:9]	3	0.12%
yellow	[10:29]	2	0.08%
greenyellow	[30:49]	2	0.08%
lawngreen	50+	255	10.8%
All colors	2353	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
532	1086	Curl_share_unlock	call site: 01086	Curl_cpool_return
445	621	curl_easy_cleanup	call site: 00621	Curl_async_shutdown
223	1817	Curl_llist_head	call site: 01817	Curl_close
155	1	LLVMFuzzerTestOneInput	call site: 00001	append
120	197	curlx_dyn_ptr	call site: 00197	curlx_dyn_addf
104	1680	sigpipe_restore	call site: 01680	Curl_conn_close
70	323	curlx_dyn_add	call site: 00323	url_sethost
57	2146	randit	call site: 02146	get_netscape_format
54	1625	Curl_hash_destroy	call site: 01625	cpool_conn_close
42	2044	Curl_close	call site: 02044	Curl_async_destroy
32	396	curlx_dyn_reset	call site: 00396	curl_url_set
29	1785	Curl_close	call site: 01785	curl_multi_cleanup

Runtime coverage analysis

Covered functions

135

Functions that are reachable but not covered

749

Reachable functions

846

Percentage of reachable functions covered

11.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_netrc.cc	17
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	5
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	3
curl/lib/curlx/dynbuf.c	16
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2
curl/lib/easy.c	21
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/bufref.c	3
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	2
curl/lib/creds.c	7
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/sigpipe.h	4
curl/lib/multi.c	117
curl/lib/progress.c	20
curl/lib/curlx/timeval.c	7
curl/lib/vdns/hostip.c	2
curl/tests/libtest/lib2453.c	2
curl/lib/uint-bset.c	5
curltool_progress.c	11
curl/lib/transfer.c	16
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ratelimit.c	6
curl/lib/cfilters.c	17
curl/lib/ws.c	2
curl/lib/bufq.c	11
curl/lib/curl_trc.c	8
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/cshutdn.c	54
curl/lib/splay.c	6
curl/lib/vdns/dnscache.c	9
curl/lib/curl_share.c	22
curl/lib/conncache.c	52
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/uint-table.c	7
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/winapi.c	4
curl/lib/multi_ev.c	53
curl/lib/select.c	25
curl/tests/unit/unit2606.c	1
curl/lib/http.c	6
curl/lib/peer.c	2
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/lib/ftplistparser.c	5
curl/lib/llist.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/vdns/asyn-thrdd.c	8
curl/lib/thrdqueue.c	15
curl/lib/thrdpool.c	19
curl/lib/curl_threads.c	5
curl/lib/curlx/wait.c	5
curl/lib/psl.c	2
curl/lib/vtls/vtls_scache.c	7
curl/lib/multi_ntfy.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/slist.c	2
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4
curl/lib/mime.c	8

Fuzzer: curl_fuzzer_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1505	49.2%
gold	[1:9]	18	0.58%
yellow	[10:29]	59	1.92%
greenyellow	[30:49]	21	0.68%
lawngreen	50+	1455	47.5%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2852	Curl_close	call site: 02852	share_unlink
21	898	curl_url_set	call site: 00898	url_sethost
21	1840	Curl_uint32_spbset_init	call site: 01840	mev_sh_entry_xfer_add

Runtime coverage analysis

Covered functions

1840

Functions that are reachable but not covered

578

Reachable functions

1330

Percentage of reachable functions covered

56.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6277	70.3%
gold	[1:9]	141	1.57%
yellow	[10:29]	58	0.64%
greenyellow	[30:49]	38	0.42%
lawngreen	50+	2412	27.0%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1131	7339	curl_multi_perform	call site: 07339	proto_fuzzer::RunScenario
779	4745	curlx_sotouz	call site: 04745	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
212	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
110	2648	cookie_tailmatch	call site: 02648	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
95	4204	multi_do	call site: 04204	myssh_multi_statemach
79	6730	http_header_a	call site: 06730	Curl_altsvc_parse

Runtime coverage analysis

Covered functions

1794

Functions that are reachable but not covered

1013

Reachable functions

1692

Percentage of reachable functions covered

40.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http3.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_http2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6139	68.7%
gold	[1:9]	62	0.69%
yellow	[10:29]	88	0.98%
greenyellow	[30:49]	19	0.21%
lawngreen	50+	2618	29.3%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
207	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1562

Functions that are reachable but not covered

1048

Reachable functions

1692

Percentage of reachable functions covered

38.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http2.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6873	76.9%
gold	[1:9]	34	0.38%
yellow	[10:29]	31	0.34%
greenyellow	[30:49]	37	0.41%
lawngreen	50+	1951	21.8%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1131	7339	curl_multi_perform	call site: 07339	proto_fuzzer::RunScenario
661	4863	Curl_xfer_setup_recv	call site: 04863	multi_done
615	6530	Curl_conn_cf_connect	call site: 06530	http_rw_hd
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
326	4536	curlx_str_word	call site: 04536	ssh_state_sftp_readdir
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
110	2648	cookie_tailmatch	call site: 02648	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
95	4204	multi_do	call site: 04204	myssh_multi_statemach
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1263

Functions that are reachable but not covered

1116

Reachable functions

1692

Percentage of reachable functions covered

34.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_gopher.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_socks4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6202	69.4%
gold	[1:9]	113	1.26%
yellow	[10:29]	89	0.99%
greenyellow	[30:49]	34	0.38%
lawngreen	50+	2488	27.8%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
665	5679	Curl_conn_recv	call site: 05679	multistate_doing_more
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
212	4302	base64_encode	call site: 04302	ssh_state_sftp_quote
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
96	4204	multi_do	call site: 04204	myssh_multi_statemach
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1379

Functions that are reachable but not covered

1062

Reachable functions

1692

Percentage of reachable functions covered

37.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_socks4.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_bufq

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	504	88.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	11.1%
All colors	567	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
422	113	Curl_bufq_pass	call site: 00113	append
14	2	LLVMFuzzerTestOneInput	call site: 00002	allocate_template_buffer
12	99	bufq_slurpn	call site: 00099	Curl_bufq_pass
10	72	Curl_bufq_read	call site: 00072	Curl_bufq_slurp
10	540	Curl_bufq_skip	call site: 00540	Curl_bufq_write
8	59	chunk_peek_at	call site: 00059	Curl_bufq_read
7	49	chunk_peek	call site: 00049	Curl_bufq_peek_at
5	556	chunk_append	call site: 00556	Curl_bufq_free
4	27	Curl_bufq_init	call site: 00027	Curl_bufq_is_empty
4	35	Curl_bufq_len	call site: 00035	Curl_bufq_peek
2	24	bufq_init	call site: 00024	FV_PRINTF
2	32	Curl_bufq_is_empty	call site: 00032	Curl_bufq_len

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

24

Reachable functions

59

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_bufq.cc	32
curl/lib/bufq.c	29
curl/docs/examples/htmltitle.cpp	1
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: fuzz_doh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	35.3%
gold	[1:9]	40	15.3%
yellow	[10:29]	2	0.76%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	126	48.4%
All colors	260	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	96	curl_mvsnprintf	call site: 00096	curl_msnprintf
12	81	out_string	call site: 00081	out_double
7	21	str_num_base	call site: 00021	curlx_str_single
7	64	out_number	call site: 00064	stream_pad
5	7	curl_easy_init	call site: 00007	curl_mfprintf
5	29	parsefmt	call site: 00029	dollarstring
5	57	formatf	call site: 00057	stream_pad
4	35	parsefmt	call site: 00035	is_arg_used
4	153	Curl_init_userdefined	call site: 00153	doh_resp_decode_httpsrr
3	2	LLVMFuzzerTestOneInput	call site: 00002	curl_easy_init
3	42	parsefmt	call site: 00042
3	49	parsefmt	call site: 00049	DEBUGASSERT

Runtime coverage analysis

Covered functions

150

Functions that are reachable but not covered

51

Reachable functions

103

Percentage of reachable functions covered

50.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_doh.cc	17
curl/lib/easy.c	6
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/u8_strset.c	2
curl/lib/curlx/dynbuf.c	6
curl/lib/bufref.c	1
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl/lib/vdns/doh.c	24
curl/lib/vdns/httpsrr.c	5
curl/lib/connect.c	1
curl/lib/curlx/strdup.c	2

Fuzzer: curl_fuzzer_proto_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5825	65.2%
gold	[1:9]	131	1.46%
yellow	[10:29]	85	0.95%
greenyellow	[30:49]	26	0.29%
lawngreen	50+	2859	32.0%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4850	curlx_str_numblanks	call site: 04850	multi_done
514	7956	curl_ws_send	call site: 07956	proto_fuzzer::RunScenario
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
212	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
205	7641	header_has_value	call site: 07641	fuzz_initialize_fuzz_data
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1681

Functions that are reachable but not covered

1023

Reachable functions

1692

Percentage of reachable functions covered

39.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_timing.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_wss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6547	73.3%
gold	[1:9]	50	0.56%
yellow	[10:29]	31	0.34%
greenyellow	[30:49]	24	0.26%
lawngreen	50+	2274	25.4%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
988	4536	curlx_str_word	call site: 04536	multi_done
514	7956	curl_ws_send	call site: 07956	proto_fuzzer::RunScenario
507	7339	curl_multi_perform	call site: 07339	curl_easy_perform
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
179	6868	http_header_c	call site: 06868	http_header_p
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
110	2648	cookie_tailmatch	call site: 02648	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
95	4204	multi_do	call site: 04204	myssh_multi_statemach
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1478

Functions that are reachable but not covered

1080

Reachable functions

1692

Percentage of reachable functions covered

36.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_wss.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5831	65.3%
gold	[1:9]	89	0.99%
yellow	[10:29]	43	0.48%
greenyellow	[30:49]	41	0.45%
lawngreen	50+	2922	32.7%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
208	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1895

Functions that are reachable but not covered

1030

Reachable functions

1692

Percentage of reachable functions covered

39.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_http_deep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5470	61.2%
gold	[1:9]	212	2.37%
yellow	[10:29]	66	0.73%
greenyellow	[30:49]	45	0.50%
lawngreen	50+	3133	35.0%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
674	4850	curlx_str_numblanks	call site: 04850	multi_done
527	7943	ws_enc_write_head	call site: 07943	proto_fuzzer::RunScenario
358	5679	Curl_conn_recv	call site: 05679	smtp_state_auth_resp
283	6061	Curl_HMAC_final	call site: 06061	multistate_doing_more
215	7641	header_has_value	call site: 07641	fuzz_initialize_fuzz_data
212	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
208	7339	curl_multi_perform	call site: 07339	curl_easy_perform
149	4365	curlx_uztoui	call site: 04365	ssh_state_sftp_quote
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
102	6900	authcmp	call site: 06900	auth_spnego
95	4204	multi_do	call site: 04204	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1814

Functions that are reachable but not covered

1004

Reachable functions

1692

Percentage of reachable functions covered

40.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http_deep.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_telnet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7062	79.1%
gold	[1:9]	36	0.40%
yellow	[10:29]	58	0.64%
greenyellow	[30:49]	22	0.24%
lawngreen	50+	1748	19.5%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1131	7339	curl_multi_perform	call site: 07339	proto_fuzzer::RunScenario
988	4536	curlx_str_word	call site: 04536	multi_done
684	6530	Curl_conn_cf_connect	call site: 06530	multi_done
665	5679	Curl_conn_recv	call site: 05679	multistate_doing_more
310	4204	multi_do	call site: 04204	myssh_multi_statemach
265	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
126	2639	Curl_host_is_ipnum	call site: 02639	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start
80	3633	proxy_detect_proxy	call site: 03633	parse_proxy
77	5525	multistate_do	call site: 05525	multi_done
72	5604	multistate_do	call site: 05604	multistate_doing

Runtime coverage analysis

Covered functions

970

Functions that are reachable but not covered

1156

Reachable functions

1692

Percentage of reachable functions covered

31.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_telnet.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1782	58.2%
gold	[1:9]	16	0.52%
yellow	[10:29]	24	0.78%
greenyellow	[30:49]	13	0.42%
lawngreen	50+	1223	39.9%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1110	Curl_poll	call site: 01110	Curl_poll
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1224

Functions that are reachable but not covered

665

Reachable functions

1330

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_gopher.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7161	80.2%
gold	[1:9]	78	0.87%
yellow	[10:29]	55	0.61%
greenyellow	[30:49]	10	0.11%
lawngreen	50+	1622	18.1%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1131	7339	curl_multi_perform	call site: 07339	proto_fuzzer::RunScenario
986	4536	curlx_str_word	call site: 04536	multi_done
699	5634	Curl_pgrsCheck	call site: 05634	smtp_pp_statemachine
619	6595	Curl_creader_set_fread	call site: 06595	multi_done
310	4204	multi_do	call site: 04204	myssh_multi_statemach
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
127	2638	Curl_host_is_ipnum	call site: 02638	datestring
104	3365	url_set_data_creds	call site: 03365	curl_url_set
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start
80	3633	proxy_detect_proxy	call site: 03633	parse_proxy
79	5523	multistate_do	call site: 05523	multi_done
65	3064	curl_url_set	call site: 03064	curl_url_set

Runtime coverage analysis

Covered functions

983

Functions that are reachable but not covered

1150

Reachable functions

1692

Percentage of reachable functions covered

32.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_tftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_rtsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1696	55.4%
gold	[1:9]	4	0.13%
yellow	[10:29]	9	0.29%
greenyellow	[30:49]	7	0.22%
lawngreen	50+	1342	43.8%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
71	1072	curlx_nonblock	call site: 01072	wakeup_inet
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2852	Curl_close	call site: 02852	share_unlink

Runtime coverage analysis

Covered functions

1339

Functions that are reachable but not covered

636

Reachable functions

1330

Percentage of reachable functions covered

52.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_rtsp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6721	75.2%
gold	[1:9]	40	0.44%
yellow	[10:29]	40	0.44%
greenyellow	[30:49]	16	0.17%
lawngreen	50+	2109	23.6%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1131	7339	curl_multi_perform	call site: 07339	proto_fuzzer::RunScenario
657	4863	Curl_xfer_setup_recv	call site: 04863	myssh_multi_statemach
631	5702	Curl_pp_readresp	call site: 05702	smtp_state_auth_resp
500	6645	Curl_req_done_sending	call site: 06645	http_rw_hd
310	4204	multi_do	call site: 04204	myssh_multi_statemach
222	8619	curl_multi_get_handles	call site: 08619	proto_fuzzer::MultiSocketDriver::DriveReady
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
104	3365	url_set_data_creds	call site: 03365	curl_url_set
94	4754	Curl_xfer_setup_send	call site: 04754	ssh_state_sftp_readdir
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start
80	3633	proxy_detect_proxy	call site: 03633	parse_proxy
77	5525	multistate_do	call site: 05525	multi_done

Runtime coverage analysis

Covered functions

1253

Functions that are reachable but not covered

1076

Reachable functions

1692

Percentage of reachable functions covered

36.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1531	50.0%
gold	[1:9]	35	1.14%
yellow	[10:29]	12	0.39%
greenyellow	[30:49]	5	0.16%
lawngreen	50+	1475	48.2%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
261	378	formadd	call site: 00378	fuzz_set_easy_options
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1072	curlx_nonblock	call site: 01072	wakeup_inet
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
33	1110	Curl_poll	call site: 01110	Curl_poll
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2852	Curl_close	call site: 02852	share_unlink
21	898	curl_url_set	call site: 00898	url_sethost
21	1840	Curl_uint32_spbset_init	call site: 01840	mev_sh_entry_xfer_add

Runtime coverage analysis

Covered functions

2141

Functions that are reachable but not covered

582

Reachable functions

1330

Percentage of reachable functions covered

56.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ldap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1773	57.9%
gold	[1:9]	22	0.71%
yellow	[10:29]	18	0.58%
greenyellow	[30:49]	15	0.49%
lawngreen	50+	1230	40.2%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
71	1072	curlx_nonblock	call site: 01072	wakeup_inet
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
39	2328	Curl_bufq_len	call site: 02328	Curl_debug
35	1996	Curl_cshutdn_terminate	call site: 01996	Curl_cshutdn_add
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
34	2380	req_flush	call site: 02380	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
30	889	curlx_dyn_add	call site: 00889	url_sethost
30	967	ipv4_normalize	call site: 00967	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1250

Functions that are reachable but not covered

661

Reachable functions

1330

Percentage of reachable functions covered

50.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ldap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1597	52.2%
gold	[1:9]	22	0.71%
yellow	[10:29]	14	0.45%
greenyellow	[30:49]	7	0.22%
lawngreen	50+	1418	46.3%
All colors	3058	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
266	378	formadd	call site: 00378	fuzz_set_easy_options
71	1072	curlx_nonblock	call site: 01072	wakeup_inet
59	1624	curl_getenv	call site: 01624	curlx_dyn_addf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
35	2175	pgrsupdate	call site: 02175	timebuf
34	1864	Curl_uint32_spbset_add	call site: 01864	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2852	Curl_close	call site: 02852	share_unlink
23	1727	mstate_connecting_pollset	call site: 01727	mstate_protocol_pollset
22	1491	Curl_pgrsTime	call site: 01491	disconnect
22	2658	Curl_freeaddrinfo	call site: 02658	Curl_doh_cleanup

Runtime coverage analysis

Covered functions

1539

Functions that are reachable but not covered

614

Reachable functions

1330

Percentage of reachable functions covered

53.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_http.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6204	69.5%
gold	[1:9]	128	1.43%
yellow	[10:29]	70	0.78%
greenyellow	[30:49]	42	0.47%
lawngreen	50+	2482	27.8%
All colors	8926	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
829	7641	header_has_value	call site: 07641	proto_fuzzer::RunScenario
674	4850	curlx_str_numblanks	call site: 04850	multi_done
665	5679	Curl_conn_recv	call site: 05679	multistate_doing_more
297	7339	curl_multi_perform	call site: 07339	curl_easy_perform
265	8629	Curl_wakeup_signal	call site: 08629	proto_fuzzer::MultiSocketDriver::DriveReady
212	4302	base64_encode	call site: 04302	ssh_state_sftp_quote
208	4536	curlx_str_word	call site: 04536	ssh_state_sftp_quote_statvfs
149	6892	http_header_p	call site: 06892	Curl_http_input_auth
104	3365	url_set_data_creds	call site: 03365	curl_url_set
103	4745	curlx_sotouz	call site: 04745	ssh_state_sftp_readdir
95	4204	multi_do	call site: 04204	myssh_multi_statemach
88	8524	curl_multi_remove_handle	call site: 08524	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1339

Functions that are reachable but not covered

1074

Reachable functions

1692

Percentage of reachable functions covered

36.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	50
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	89
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	8
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl/tests/server/dnsd.c	1
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3