High level conclusions

Fuzzer fuzz_netrc is blocked:

The runtime code coverage of fuzz_netrc covers 11.45% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer curl_fuzzer_full_coverage is blocked:

The runtime code coverage of curl_fuzzer_full_coverage covers 6.128% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 15.84% of cyclomatic complexity.

Fuzzers reach 20.02% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1373 / 6855

Cyclomatic complexity statically reachable by fuzzers

5612 / 35418

Runtime code coverage of functions

2935 / 6855

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: curl_fuzzer_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1831	59.6%
gold	[1:9]	10	0.32%
yellow	[10:29]	16	0.52%
greenyellow	[30:49]	12	0.39%
lawngreen	50+	1199	39.0%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
71	1078	curlx_nonblock	call site: 01078	wakeup_inet
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2336	Curl_bufq_len	call site: 02336	Curl_debug
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
32	1735	mstate_connecting_pollset	call site: 01735	mstate_perform_pollset
30	895	curlx_dyn_add	call site: 00895	url_sethost

Runtime coverage analysis

Covered functions

1093

Functions that are reachable but not covered

708

Reachable functions

1330

Percentage of reachable functions covered

46.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_tftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6578	73.4%
gold	[1:9]	56	0.62%
yellow	[10:29]	39	0.43%
greenyellow	[30:49]	26	0.29%
lawngreen	50+	2262	25.2%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
989	4554	curlx_str_word	call site: 04554	multi_done
518	7978	curl_ws_send	call site: 07978	proto_fuzzer::RunScenario
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
212	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
205	7663	header_has_value	call site: 07663	fuzz_initialize_fuzz_data
179	6890	http_header_c	call site: 06890	http_header_p
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
110	2660	cookie_tailmatch	call site: 02660	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1301

Functions that are reachable but not covered

1087

Reachable functions

1693

Percentage of reachable functions covered

35.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ws.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_smtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1719	56.0%
gold	[1:9]	13	0.42%
yellow	[10:29]	17	0.55%
greenyellow	[30:49]	10	0.32%
lawngreen	50+	1309	42.6%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1374

Functions that are reachable but not covered

651

Reachable functions

1330

Percentage of reachable functions covered

51.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_smtp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_multi

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5728	63.9%
gold	[1:9]	32	0.35%
yellow	[10:29]	102	1.13%
greenyellow	[30:49]	47	0.52%
lawngreen	50+	3052	34.0%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
746	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
265	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1703

Functions that are reachable but not covered

972

Reachable functions

1693

Percentage of reachable functions covered

42.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_multi.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5689	63.4%
gold	[1:9]	85	0.94%
yellow	[10:29]	40	0.44%
greenyellow	[30:49]	43	0.47%
lawngreen	50+	3104	34.6%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
675	4868	curlx_str_numblanks	call site: 04868	multi_done
559	7937	Curl_senddata	call site: 07937	proto_fuzzer::RunScenario
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
293	7365	curl_easy_perform	call site: 07365	curl_easy_perform
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
269	7663	header_has_value	call site: 07663	fuzz_initialize_fuzz_data
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
170	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1824

Functions that are reachable but not covered

967

Reachable functions

1693

Percentage of reachable functions covered

42.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_api.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_imap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1711	55.7%
gold	[1:9]	7	0.22%
yellow	[10:29]	21	0.68%
greenyellow	[30:49]	19	0.61%
lawngreen	50+	1310	42.6%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1368

Functions that are reachable but not covered

643

Reachable functions

1330

Percentage of reachable functions covered

51.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_imap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1793	58.4%
gold	[1:9]	18	0.58%
yellow	[10:29]	14	0.45%
greenyellow	[30:49]	12	0.39%
lawngreen	50+	1231	40.1%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2336	Curl_bufq_len	call site: 02336	Curl_debug
40	2382	Curl_bufq_skip	call site: 02382	Curl_xfer_send_shutdown
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
36	2183	pgrsupdate	call site: 02183	timebuf
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
32	1539	curlx_strerror	call site: 01539	Curl_cshutdn_try_once_idx

Runtime coverage analysis

Covered functions

1270

Functions that are reachable but not covered

693

Reachable functions

1330

Percentage of reachable functions covered

47.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_https.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ws

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1665	54.2%
gold	[1:9]	9	0.29%
yellow	[10:29]	16	0.52%
greenyellow	[30:49]	3	0.09%
lawngreen	50+	1375	44.8%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
32	1539	curlx_strerror	call site: 01539	Curl_cshutdn_try_once_idx
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1715

Functions that are reachable but not covered

614

Reachable functions

1330

Percentage of reachable functions covered

53.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ws.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_resolver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6381	71.2%
gold	[1:9]	77	0.85%
yellow	[10:29]	61	0.68%
greenyellow	[30:49]	32	0.35%
lawngreen	50+	2410	26.8%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
666	5699	Curl_conn_recv	call site: 05699	multistate_doing_more
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
212	4320	base64_encode	call site: 04320	ssh_state_sftp_quote
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
97	4221	multi_do	call site: 04221	myssh_multi_statemach
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1343

Functions that are reachable but not covered

1087

Reachable functions

1693

Percentage of reachable functions covered

35.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_resolver.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5513	61.5%
gold	[1:9]	108	1.20%
yellow	[10:29]	70	0.78%
greenyellow	[30:49]	68	0.75%
lawngreen	50+	3202	35.7%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
675	4868	curlx_str_numblanks	call site: 04868	multi_done
518	7978	curl_ws_send	call site: 07978	proto_fuzzer::RunScenario
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
212	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
207	7361	curl_multi_perform	call site: 07361	curl_easy_perform
205	7663	header_has_value	call site: 07663	fuzz_initialize_fuzz_data
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego

Runtime coverage analysis

Covered functions

1963

Functions that are reachable but not covered

1000

Reachable functions

1693

Percentage of reachable functions covered

40.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1936	63.1%
gold	[1:9]	23	0.74%
yellow	[10:29]	12	0.39%
greenyellow	[30:49]	65	2.11%
lawngreen	50+	1032	33.6%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
105	1608	Curl_xfer_recv_is_paused	call site: 01608	url_query
82	1067	wakeup_eventfd	call site: 01067	wakeup_inet
55	2068	cshutdn_perform	call site: 02068	Curl_cshutdn_terminate
52	1500	cshutdn_run_conn_handler	call site: 01500	loghex
50	2325	prune_head	call site: 02325	xfer_send
49	2986	curl_multi_perform	call site: 02986	curl_multi_perform
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
42	2646	Curl_close	call site: 02646	Curl_async_destroy
38	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
38	1912	Curl_multi_get_easy	call site: 01912	Curl_uint32_spbset_next
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add

Runtime coverage analysis

Covered functions

776

Functions that are reachable but not covered

794

Reachable functions

1330

Percentage of reachable functions covered

40.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_file.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_mqtt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1784	58.1%
gold	[1:9]	11	0.35%
yellow	[10:29]	23	0.74%
greenyellow	[30:49]	15	0.48%
lawngreen	50+	1235	40.2%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
71	1078	curlx_nonblock	call site: 01078	wakeup_inet
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0

Runtime coverage analysis

Covered functions

1137

Functions that are reachable but not covered

679

Reachable functions

1330

Percentage of reachable functions covered

48.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_mqtt.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https_gnutls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5908	65.9%
gold	[1:9]	100	1.11%
yellow	[10:29]	58	0.64%
greenyellow	[30:49]	40	0.44%
lawngreen	50+	2855	31.8%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
208	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1940

Functions that are reachable but not covered

1036

Reachable functions

1693

Percentage of reachable functions covered

38.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_gnutls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_pop3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1762	57.4%
gold	[1:9]	12	0.39%
yellow	[10:29]	20	0.65%
greenyellow	[30:49]	12	0.39%
lawngreen	50+	1262	41.1%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1314

Functions that are reachable but not covered

655

Reachable functions

1330

Percentage of reachable functions covered

50.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_pop3.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_https_h2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6175	68.9%
gold	[1:9]	100	1.11%
yellow	[10:29]	58	0.64%
greenyellow	[30:49]	25	0.27%
lawngreen	50+	2603	29.0%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
207	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1883

Functions that are reachable but not covered

1039

Reachable functions

1693

Percentage of reachable functions covered

38.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_h2.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	271	63.9%
gold	[1:9]	2	0.47%
yellow	[10:29]	11	2.59%
greenyellow	[30:49]	3	0.70%
lawngreen	50+	137	32.3%
All colors	424	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	308	curl_url_cleanup	call site: 00308	url_sethost
39	261	Curl_urldecode	call site: 00261	curl_mfprintf
31	219	curlx_dyn_vprintf	call site: 00219	curl_mvaprintf
20	134	curl_mvsnprintf	call site: 00134	curl_url_get
19	112	formatf	call site: 00112	out_double
12	409	ipv4_normalize	call site: 00409	ipv4_normalize
11	19	free_urlhandle	call site: 00019	curlx_strzero
8	156	urlget_url	call site: 00156	file_url
8	197	curlx_dyn_ptr	call site: 00197	curlx_dyn_addf
7	53	curl_url_set	call site: 00053	curl_url_set
7	102	out_number	call site: 00102	stream_pad
6	36	Curl_get_scheme	call site: 00036	set_url_port

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

96

Reachable functions

167

Percentage of reachable functions covered

42.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_url.cc	7
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/tests/libtest/lib1560.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_dict

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1793	58.4%
gold	[1:9]	8	0.26%
yellow	[10:29]	23	0.74%
greenyellow	[30:49]	11	0.35%
lawngreen	50+	1233	40.1%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1126

Functions that are reachable but not covered

668

Reachable functions

1330

Percentage of reachable functions covered

49.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_dict.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_full_coverage

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	952	66.6%
gold	[1:9]	304	21.2%
yellow	[10:29]	95	6.64%
greenyellow	[30:49]	17	1.18%
lawngreen	50+	61	4.26%
All colors	1429	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
455	973	curlx_uztosi	call site: 00973	fuzz_initialize_fuzz_data
162	642	Curl_urldecode	call site: 00642	curl_url_set
74	528	readback_part	call site: 00528	append
25	168	curl_mfprintf	call site: 00168	full_coverage::ExerciseVariadicFormatting
16	619	curl_easy_escape	call site: 00619	curl_maprintf
14	867	Curl_http2_ver	call site: 00867	Curl_quic_ver
13	348	randit	call site: 00348	weak_random
10	854	idn_version	call site: 00854	psl_version
8	158	curl_mvfprintf	call site: 00158	full_coverage::ExerciseVariadicStdout
8	605	curlx_dyn_vprintf	call site: 00605	curl_mvaprintf
7	103	curl_mvsnprintf	call site: 00103	curl_msnprintf
7	313	curl_formadd	call site: 00313

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

1210

Reachable functions

1289

Percentage of reachable functions covered

6.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_full_coverage.cc	8
curl_fuzzer/full_coverage/public_api.cc	25
curl/lib/easy.c	14
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/escape.c	12
curl/lib/curlx/dynbuf.c	14
curl/lib/formdata.c	45
curl/lib/bufref.c	6
curl/lib/curlx/strdup.c	5
curl/lib/mime.c	59
curl/lib/strequal.c	3
curl/lib/slist.c	6
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	2
curl/lib/curlx/timeval.c	2
curl/lib/curlx/basename.c	1
curl/lib/curlx/warnless.c	1
curl/tests/libtest/lib553.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	3
curl/lib/vquic/vquic.c	3
curl/lib/amigaos.c	2
curl_fuzzer/full_coverage/utility_api.cc	13
curl/lib/version.c	22
curl/lib/vtls/vtls.c	4
curl/lib/http2.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/lib/openldap.c	4
curl/lib/parsedate.c	25
curl_fuzzer/full_coverage/dynamic_formatting.cc	7
curl_fuzzer/full_coverage/legacy_mutator.cc	26
curl/lib/splay.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/u8_strset.c	2
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl_fuzzer/legacy_tlv_mutator.cc	60
curl_fuzzer/tests/full_coverage_mutator_test.cc	3
curl_fuzzer/tests/nghttp2_contract_shim_test.cc	1
curltool_paramhlp.c	3

Fuzzer: curl_fuzzer_proto_h2_proxy

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6435	71.8%
gold	[1:9]	85	0.94%
yellow	[10:29]	78	0.87%
greenyellow	[30:49]	52	0.58%
lawngreen	50+	2311	25.7%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
110	2660	cookie_tailmatch	call site: 02660	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1673

Functions that are reachable but not covered

1065

Reachable functions

1693

Percentage of reachable functions covered

37.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_h2_proxy.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_https_mbedtls

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5902	65.8%
gold	[1:9]	89	0.99%
yellow	[10:29]	52	0.58%
greenyellow	[30:49]	43	0.47%
lawngreen	50+	2875	32.0%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
208	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1913

Functions that are reachable but not covered

1033

Reachable functions

1693

Percentage of reachable functions covered

38.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https_mbedtls.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_socks4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6310	70.4%
gold	[1:9]	96	1.07%
yellow	[10:29]	48	0.53%
greenyellow	[30:49]	38	0.42%
lawngreen	50+	2469	27.5%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
666	5699	Curl_conn_recv	call site: 05699	multistate_doing_more
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
212	4320	base64_encode	call site: 04320	ssh_state_sftp_quote
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
97	4221	multi_do	call site: 04221	myssh_multi_statemach
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1427

Functions that are reachable but not covered

1071

Reachable functions

1693

Percentage of reachable functions covered

36.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_socks4.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_bufq

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	510	89.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	10.9%
All colors	573	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
428	113	Curl_bufq_pass	call site: 00113	append
14	2	LLVMFuzzerTestOneInput	call site: 00002	allocate_template_buffer
12	99	bufq_slurpn	call site: 00099	Curl_bufq_pass
10	72	Curl_bufq_read	call site: 00072	Curl_bufq_slurp
10	546	Curl_bufq_skip	call site: 00546	Curl_bufq_write
8	59	chunk_peek_at	call site: 00059	Curl_bufq_read
7	49	chunk_peek	call site: 00049	Curl_bufq_peek_at
5	562	chunk_append	call site: 00562	Curl_bufq_free
4	27	Curl_bufq_init	call site: 00027	Curl_bufq_is_empty
4	35	Curl_bufq_len	call site: 00035	Curl_bufq_peek
2	24	bufq_init	call site: 00024	FV_PRINTF
2	32	Curl_bufq_is_empty	call site: 00032	Curl_bufq_len

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

24

Reachable functions

59

Percentage of reachable functions covered

59.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_bufq.cc	32
curl/lib/bufq.c	29
curl/docs/examples/htmltitle.cpp	1
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	4
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	2
curl/lib/curlx/dynbuf.c	14
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2

Fuzzer: curl_fuzzer_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1531	49.9%
gold	[1:9]	55	1.79%
yellow	[10:29]	22	0.71%
greenyellow	[30:49]	11	0.35%
lawngreen	50+	1449	47.2%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2860	Curl_close	call site: 02860	share_unlink
21	904	curl_url_set	call site: 00904	url_sethost
21	1848	Curl_uint32_spbset_init	call site: 01848	mev_sh_entry_xfer_add

Runtime coverage analysis

Covered functions

1893

Functions that are reachable but not covered

579

Reachable functions

1330

Percentage of reachable functions covered

56.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ftp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http2

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6243	69.6%
gold	[1:9]	63	0.70%
yellow	[10:29]	52	0.58%
greenyellow	[30:49]	15	0.16%
lawngreen	50+	2588	28.8%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
207	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1613

Functions that are reachable but not covered

1057

Reachable functions

1693

Percentage of reachable functions covered

37.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http2.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_netrc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2099	88.9%
gold	[1:9]	4	0.16%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	2	0.08%
lawngreen	50+	255	10.8%
All colors	2361	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
532	1094	Curl_share_unlock	call site: 01094	Curl_cpool_return
447	627	curl_easy_cleanup	call site: 00627	Curl_async_shutdown
223	1825	Curl_llist_head	call site: 01825	Curl_close
155	1	LLVMFuzzerTestOneInput	call site: 00001	append
126	197	curlx_dyn_ptr	call site: 00197	curlx_dyn_addf
104	1688	sigpipe_restore	call site: 01688	Curl_conn_close
70	329	curlx_dyn_add	call site: 00329	url_sethost
57	2154	randit	call site: 02154	get_netscape_format
54	1633	Curl_hash_destroy	call site: 01633	cpool_conn_close
42	2052	Curl_close	call site: 02052	Curl_async_destroy
32	402	curlx_dyn_reset	call site: 00402	curl_url_set
29	1793	Curl_close	call site: 01793	curl_multi_cleanup

Runtime coverage analysis

Covered functions

135

Functions that are reachable but not covered

750

Reachable functions

847

Percentage of reachable functions covered

11.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_netrc.cc	17
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/curlx/strdup.c	5
curl/lib/protocol.c	2
curl/lib/curlx/strparse.c	5
curl/lib/mprintf.c	41
curl/lib/curlx/snprintf.c	3
curl/lib/strequal.c	3
curl/lib/curlx/dynbuf.c	16
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/curlx/strcopy.c	2
curl/lib/easy.c	21
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/bufref.c	3
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	2
curl/lib/creds.c	7
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/sigpipe.h	4
curl/lib/multi.c	117
curl/lib/progress.c	20
curl/lib/curlx/timeval.c	7
curl/lib/vdns/hostip.c	2
curl/tests/libtest/lib2453.c	2
curl/lib/uint-bset.c	5
curltool_progress.c	11
curl/lib/transfer.c	16
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ratelimit.c	6
curl/lib/cfilters.c	17
curl/lib/ws.c	2
curl/lib/bufq.c	11
curl/lib/curl_trc.c	8
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/cshutdn.c	54
curl/lib/splay.c	6
curl/lib/vdns/dnscache.c	9
curl/lib/curl_share.c	22
curl/lib/conncache.c	52
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/uint-table.c	7
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/winapi.c	4
curl/lib/multi_ev.c	53
curl/lib/select.c	25
curl/tests/unit/unit2606.c	1
curl/lib/http.c	6
curl/lib/peer.c	2
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/lib/ftplistparser.c	5
curl/lib/llist.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/vdns/asyn-thrdd.c	8
curl/lib/thrdqueue.c	15
curl/lib/thrdpool.c	19
curl/lib/curl_threads.c	5
curl/lib/curlx/wait.c	5
curl/lib/psl.c	2
curl/lib/vtls/vtls_scache.c	7
curl/lib/multi_ntfy.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/slist.c	2
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4
curl/lib/mime.c	8

Fuzzer: curl_fuzzer_proto_http3

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6347	70.8%
gold	[1:9]	136	1.51%
yellow	[10:29]	62	0.69%
greenyellow	[30:49]	33	0.36%
lawngreen	50+	2383	26.5%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1135	7361	curl_multi_perform	call site: 07361	proto_fuzzer::RunScenario
780	4763	curlx_sotouz	call site: 04763	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
212	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
110	2660	cookie_tailmatch	call site: 02660	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
96	4221	multi_do	call site: 04221	myssh_multi_statemach
79	6752	http_header_a	call site: 06752	Curl_altsvc_parse

Runtime coverage analysis

Covered functions

1806

Functions that are reachable but not covered

1015

Reachable functions

1693

Percentage of reachable functions covered

40.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http3.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6933	77.3%
gold	[1:9]	36	0.40%
yellow	[10:29]	29	0.32%
greenyellow	[30:49]	68	0.75%
lawngreen	50+	1895	21.1%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1135	7361	curl_multi_perform	call site: 07361	proto_fuzzer::RunScenario
676	6491	Curl_expire_clear	call site: 06491	http_rw_hd
662	4881	Curl_xfer_setup_recv	call site: 04881	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
326	4554	curlx_str_word	call site: 04554	ssh_state_sftp_readdir
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
110	2660	cookie_tailmatch	call site: 02660	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
96	4221	multi_do	call site: 04221	myssh_multi_statemach
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1271

Functions that are reachable but not covered

1118

Reachable functions

1693

Percentage of reachable functions covered

33.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_gopher.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_timing

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5849	65.2%
gold	[1:9]	97	1.08%
yellow	[10:29]	73	0.81%
greenyellow	[30:49]	29	0.32%
lawngreen	50+	2913	32.5%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
675	4868	curlx_str_numblanks	call site: 04868	multi_done
518	7978	curl_ws_send	call site: 07978	proto_fuzzer::RunScenario
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
212	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
205	7663	header_has_value	call site: 07663	fuzz_initialize_fuzz_data
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir

Runtime coverage analysis

Covered functions

1754

Functions that are reachable but not covered

1022

Reachable functions

1693

Percentage of reachable functions covered

39.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_timing.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: fuzz_doh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	92	35.3%
gold	[1:9]	40	15.3%
yellow	[10:29]	1	0.38%
greenyellow	[30:49]	1	0.38%
lawngreen	50+	126	48.4%
All colors	260	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	96	curl_mvsnprintf	call site: 00096	curl_msnprintf
12	81	out_string	call site: 00081	out_double
7	21	str_num_base	call site: 00021	curlx_str_single
7	64	out_number	call site: 00064	stream_pad
5	7	curl_easy_init	call site: 00007	curl_mfprintf
5	29	parsefmt	call site: 00029	dollarstring
5	57	formatf	call site: 00057	stream_pad
4	35	parsefmt	call site: 00035	is_arg_used
4	153	Curl_init_userdefined	call site: 00153	doh_resp_decode_httpsrr
3	2	LLVMFuzzerTestOneInput	call site: 00002	curl_easy_init
3	42	parsefmt	call site: 00042
3	49	parsefmt	call site: 00049	DEBUGASSERT

Runtime coverage analysis

Covered functions

150

Functions that are reachable but not covered

51

Reachable functions

103

Percentage of reachable functions covered

50.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzz_doh.cc	17
curl/lib/easy.c	6
curl/lib/mprintf.c	33
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	15
curl/lib/hash.c	1
curl/lib/u8_strset.c	2
curl/lib/curlx/dynbuf.c	6
curl/lib/bufref.c	1
curl/lib/request.c	1
curl/lib/getinfo.c	3
curl/lib/netrc.c	1
curl/lib/setopt.c	2
curl/lib/vdns/doh.c	24
curl/lib/vdns/httpsrr.c	5
curl/lib/connect.c	1
curl/lib/curlx/strdup.c	2

Fuzzer: curl_fuzzer_proto_wss

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6607	73.7%
gold	[1:9]	50	0.55%
yellow	[10:29]	29	0.32%
greenyellow	[30:49]	12	0.13%
lawngreen	50+	2263	25.2%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
989	4554	curlx_str_word	call site: 04554	multi_done
518	7978	curl_ws_send	call site: 07978	proto_fuzzer::RunScenario
507	7361	curl_multi_perform	call site: 07361	curl_easy_perform
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
179	6890	http_header_c	call site: 06890	http_header_p
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
110	2660	cookie_tailmatch	call site: 02660	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
96	4221	multi_do	call site: 04221	myssh_multi_statemach
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1486

Functions that are reachable but not covered

1082

Reachable functions

1693

Percentage of reachable functions covered

36.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_wss.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_https

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5886	65.6%
gold	[1:9]	80	0.89%
yellow	[10:29]	55	0.61%
greenyellow	[30:49]	27	0.30%
lawngreen	50+	2913	32.5%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
208	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1961

Functions that are reachable but not covered

1032

Reachable functions

1693

Percentage of reachable functions covered

39.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_https.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_http_deep

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5579	62.2%
gold	[1:9]	133	1.48%
yellow	[10:29]	64	0.71%
greenyellow	[30:49]	67	0.74%
lawngreen	50+	3118	34.7%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
675	4868	curlx_str_numblanks	call site: 04868	multi_done
531	7965	ws_enc_write_head	call site: 07965	proto_fuzzer::RunScenario
359	5699	Curl_conn_recv	call site: 05699	smtp_state_auth_resp
283	6082	Curl_HMAC_final	call site: 06082	multistate_doing_more
215	7663	header_has_value	call site: 07663	fuzz_initialize_fuzz_data
212	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
208	7361	curl_multi_perform	call site: 07361	curl_easy_perform
149	4383	curlx_uztoui	call site: 04383	ssh_state_sftp_quote
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
102	6922	authcmp	call site: 06922	auth_spnego
96	4221	multi_do	call site: 04221	myssh_multi_statemach

Runtime coverage analysis

Covered functions

1871

Functions that are reachable but not covered

1012

Reachable functions

1693

Percentage of reachable functions covered

40.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http_deep.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_tftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7217	80.5%
gold	[1:9]	74	0.82%
yellow	[10:29]	64	0.71%
greenyellow	[30:49]	7	0.07%
lawngreen	50+	1599	17.8%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1135	7361	curl_multi_perform	call site: 07361	proto_fuzzer::RunScenario
987	4554	curlx_str_word	call site: 04554	multi_done
699	5655	Curl_pgrsCheck	call site: 05655	smtp_pp_statemachine
619	6617	Curl_creader_set_fread	call site: 06617	multi_done
311	4221	multi_do	call site: 04221	myssh_multi_statemach
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
127	2650	Curl_host_is_ipnum	call site: 02650	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start
80	3647	proxy_detect_proxy	call site: 03647	parse_proxy
79	5542	multistate_do	call site: 05542	multi_done
61	6372	multistate_did	call site: 06372	multistate_performing

Runtime coverage analysis

Covered functions

989

Functions that are reachable but not covered

1152

Reachable functions

1693

Percentage of reachable functions covered

31.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_tftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_telnet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7118	79.4%
gold	[1:9]	36	0.40%
yellow	[10:29]	64	0.71%
greenyellow	[30:49]	9	0.10%
lawngreen	50+	1734	19.3%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1135	7361	curl_multi_perform	call site: 07361	proto_fuzzer::RunScenario
989	4554	curlx_str_word	call site: 04554	multi_done
745	6491	Curl_expire_clear	call site: 06491	multi_done
666	5699	Curl_conn_recv	call site: 05699	multistate_doing_more
311	4221	multi_do	call site: 04221	myssh_multi_statemach
265	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
126	2651	Curl_host_is_ipnum	call site: 02651	datestring
104	3378	url_set_data_creds	call site: 03378	curl_url_set
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start
80	3647	proxy_detect_proxy	call site: 03647	parse_proxy
77	5544	multistate_do	call site: 05544	multi_done
74	5623	multistate_do	call site: 05623	multistate_doing

Runtime coverage analysis

Covered functions

976

Functions that are reachable but not covered

1158

Reachable functions

1693

Percentage of reachable functions covered

31.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_telnet.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_gopher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1790	58.3%
gold	[1:9]	17	0.55%
yellow	[10:29]	19	0.61%
greenyellow	[30:49]	11	0.35%
lawngreen	50+	1231	40.1%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1223

Functions that are reachable but not covered

666

Reachable functions

1330

Percentage of reachable functions covered

49.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_gopher.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1609	52.4%
gold	[1:9]	21	0.68%
yellow	[10:29]	15	0.48%
greenyellow	[30:49]	7	0.22%
lawngreen	50+	1416	46.1%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
33	646	curlx_strcopy	call site: 00646	append
33	1116	Curl_poll	call site: 01116	Curl_poll
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2860	Curl_close	call site: 02860	share_unlink
23	1735	mstate_connecting_pollset	call site: 01735	mstate_protocol_pollset
22	1497	Curl_pgrsTime	call site: 01497	disconnect

Runtime coverage analysis

Covered functions

1591

Functions that are reachable but not covered

614

Reachable functions

1330

Percentage of reachable functions covered

53.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_http.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_rtsp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1706	55.6%
gold	[1:9]	3	0.09%
yellow	[10:29]	5	0.16%
greenyellow	[30:49]	8	0.26%
lawngreen	50+	1346	43.8%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
71	1078	curlx_nonblock	call site: 01078	wakeup_inet
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
33	646	curlx_strcopy	call site: 00646	append
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2860	Curl_close	call site: 02860	share_unlink

Runtime coverage analysis

Covered functions

1331

Functions that are reachable but not covered

637

Reachable functions

1330

Percentage of reachable functions covered

52.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_rtsp.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_ldap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1782	58.0%
gold	[1:9]	15	0.48%
yellow	[10:29]	25	0.81%
greenyellow	[30:49]	11	0.35%
lawngreen	50+	1235	40.2%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	382	curl_formadd	call site: 00382	fuzz_set_easy_options
71	1078	curlx_nonblock	call site: 01078	wakeup_inet
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
39	2336	Curl_bufq_len	call site: 02336	Curl_debug
35	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2388	req_flush	call site: 02388	Curl_xfer_send_shutdown
33	646	curlx_strcopy	call site: 00646	append
30	895	curlx_dyn_add	call site: 00895	url_sethost
30	973	ipv4_normalize	call site: 00973	fuzz_handle_transfer

Runtime coverage analysis

Covered functions

1253

Functions that are reachable but not covered

662

Reachable functions

1330

Percentage of reachable functions covered

50.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_ldap.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1547	50.4%
gold	[1:9]	28	0.91%
yellow	[10:29]	11	0.35%
greenyellow	[30:49]	10	0.32%
lawngreen	50+	1472	47.9%
All colors	3068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
257	382	curl_formadd	call site: 00382	fuzz_set_easy_options
61	1630	curl_getenv	call site: 01630	errorf
43	155	Curl_init_userdefined	call site: 00155	curl_mfprintf
37	1078	curlx_nonblock	call site: 01078	wakeup_inet
35	2183	pgrsupdate	call site: 02183	timebuf
34	1872	Curl_uint32_spbset_add	call site: 01872	mev_forget_socket
34	2004	Curl_cshutdn_terminate	call site: 02004	Curl_cshutdn_add
33	1116	Curl_poll	call site: 01116	Curl_poll
29	307	Curl_bufref_memdup0	call site: 00307	Curl_bufref_memdup0
25	2860	Curl_close	call site: 02860	share_unlink
21	904	curl_url_set	call site: 00904	url_sethost
21	1848	Curl_uint32_spbset_init	call site: 01848	mev_sh_entry_xfer_add

Runtime coverage analysis

Covered functions

2196

Functions that are reachable but not covered

583

Reachable functions

1330

Percentage of reachable functions covered

56.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer.cc	2
curl_fuzzer/legacy_fuzzer.cc	48
curl/lib/easy.c	21
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	4
curl/lib/curlx/snprintf.c	3
curl/lib/url.c	58
curl/lib/hash.c	21
curl/lib/u8_strset.c	6
curl/lib/curlx/dynbuf.c	16
curl/lib/bufref.c	6
curl/lib/request.c	35
curl/lib/getinfo.c	3
curl/lib/netrc.c	3
curl/lib/setopt.c	2
curl_fuzzer/curl_fuzzer_tlv.cc	27
curl/lib/slist.c	8
curl/lib/mime.c	18
curl/lib/rand.c	13
curl/lib/curlx/winapi.c	4
curl/lib/curlx/timeval.c	7
curl/lib/curlx/strdup.c	5
curl/lib/formdata.c	26
curl/lib/strequal.c	2
curl_fuzzer/legacy_protocol_allowlist.cc	7
curl/lib/version.c	14
curl/lib/vtls/vtls.c	4
curl/lib/curlx/strcopy.c	2
curl/lib/vssh/libssh.c	2
curl/lib/vquic/vquic.c	2
curl/lib/vquic/cf-ngtcp2-cmn.c	3
curl/lib/vquic/cf-quiche.c	2
curl/tests/libtest/lib1560.c	9
curl/lib/urlapi.c	65
curl/lib/protocol.c	2
curl/lib/escape.c	8
curl/lib/idn.c	2
curl/lib/curlx/inet_pton.c	7
curl/lib/curlx/inet_ntop.c	7
curl/lib/multi.c	157
curl/lib/splay.c	7
curl/lib/vdns/dnscache.c	10
curl/lib/multi_ntfy.c	3
curl/lib/multi_ev.c	54
curl/lib/uint-table.c	9
curl/lib/uint-bset.c	8
curl/lib/cshutdn.c	57
curl/lib/conncache.c	55
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	30
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	1
curl/lib/select.c	25
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	4
curl/lib/vdns/asyn-thrdd.c	14
curl/lib/thrdqueue.c	24
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/lib/sigpipe.h	4
curl/lib/uint-spbset.c	14
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curltool_util.c	1
curl/lib/connect.c	1
curl/lib/progress.c	20
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/cfilters.c	17
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	16
curltool_getparam.c	23
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	6
curl/lib/bufq.c	11
curl/lib/peer.c	2
curl/lib/creds.c	3
curl/lib/vtls/vtls_config.c	2
curl/lib/ptrarray.c	8
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	15
curl/lib/content_encoding.c	5
curl/lib/ws.c	2
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	5
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	2
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	1
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/cookie.c	27
curl/lib/curl_fopen.c	20
curl/lib/altsvc.c	15
curl/lib/hsts.c	19
curl/lib/http_digest.c	1
curl/lib/vauth/digest_sspi.c	4

Fuzzer: curl_fuzzer_proto_http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6308	70.3%
gold	[1:9]	79	0.88%
yellow	[10:29]	58	0.64%
greenyellow	[30:49]	33	0.36%
lawngreen	50+	2483	27.7%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
833	7663	header_has_value	call site: 07663	proto_fuzzer::RunScenario
675	4868	curlx_str_numblanks	call site: 04868	multi_done
666	5699	Curl_conn_recv	call site: 05699	multistate_doing_more
297	7361	curl_multi_perform	call site: 07361	curl_easy_perform
265	8664	Curl_wakeup_signal	call site: 08664	proto_fuzzer::MultiSocketDriver::DriveReady
212	4320	base64_encode	call site: 04320	ssh_state_sftp_quote
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
149	6914	http_header_p	call site: 06914	Curl_http_input_auth
104	3378	url_set_data_creds	call site: 03378	curl_url_set
103	4763	curlx_sotouz	call site: 04763	ssh_state_sftp_readdir
96	4221	multi_do	call site: 04221	myssh_multi_statemach
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start

Runtime coverage analysis

Covered functions

1396

Functions that are reachable but not covered

1083

Reachable functions

1693

Percentage of reachable functions covered

36.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_http.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3

Fuzzer: curl_fuzzer_proto_ftp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6784	75.7%
gold	[1:9]	40	0.44%
yellow	[10:29]	11	0.12%
greenyellow	[30:49]	40	0.44%
lawngreen	50+	2086	23.2%
All colors	8961	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1135	7361	curl_multi_perform	call site: 07361	proto_fuzzer::RunScenario
658	4881	Curl_xfer_setup_recv	call site: 04881	myssh_multi_statemach
631	5723	Curl_pp_readresp	call site: 05723	smtp_state_auth_resp
500	6667	Curl_req_done_sending	call site: 06667	http_rw_hd
311	4221	multi_do	call site: 04221	myssh_multi_statemach
222	8654	curl_multi_get_handles	call site: 08654	proto_fuzzer::MultiSocketDriver::DriveReady
208	4554	curlx_str_word	call site: 04554	ssh_state_sftp_quote_statvfs
104	3378	url_set_data_creds	call site: 03378	curl_url_set
94	4772	Curl_xfer_setup_send	call site: 04772	ssh_state_sftp_readdir
88	8559	curl_multi_remove_handle	call site: 08559	proto_fuzzer::MultiSocketDriver::Start
80	3647	proxy_detect_proxy	call site: 03647	parse_proxy
77	5544	multistate_do	call site: 05544	multi_done

Runtime coverage analysis

Covered functions

1260

Functions that are reachable but not covered

1079

Reachable functions

1693

Percentage of reachable functions covered

36.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
curl_fuzzer/fuzzer_entrypoints/curl_fuzzer_proto_ftp.cc	2
curl_fuzzer/proto_fuzzer/fuzzer_main.cc	26
curl_fuzzer/proto_fuzzer/allocation_fault_injection.cc	9
curl_fuzzer/proto_fuzzer/target_policy.cc	306
curl/docs/examples/ftpuploadresume.c	8
curl/lib/easy.c	72
curl/lib/multi.c	260
curl/lib/conncache.c	80
curl/lib/url.c	149
curl/lib/uint-table.c	9
curl/lib/uint-spbset.c	14
curl/lib/hash.c	21
curl/lib/http_aws_sigv4.c	4
curl/lib/sha256.c	10
curl/lib/escape.c	8
curltool_util.c	1
curl/lib/cshutdn.c	58
curl/lib/connect.c	52
curl/lib/progress.c	30
curl/lib/curlx/timeval.c	7
curl/lib/splay.c	9
curl/lib/mprintf.c	41
curl/lib/curlx/strparse.c	15
curl/lib/curlx/snprintf.c	3
curl/tests/server/mqttd.c	6
curl/tests/server/util.c	13
curltoolx/tool_time.c	3
curl/lib/curlx/strerr.c	13
curl/lib/curlx/strcopy.c	2
curl/lib/curlx/winapi.c	4
curl/lib/cfilters.c	25
curl/lib/multi_ev.c	58
curl/lib/select.c	27
curl/tests/unit/unit2606.c	1
curl/lib/transfer.c	90
curltool_getparam.c	23
curl/lib/curlx/dynbuf.c	16
curltool_msgs.c	11
curlterminal.c	6
curl/lib/getenv.c	5
curltool_paramhlp.c	10
curl/lib/curlx/win32-fopen.c	3
curl/lib/ratelimit.c	6
curl/lib/http.c	161
curl/lib/request.c	47
curl/lib/bufq.c	22
curl/lib/peer.c	35
curl/lib/creds.c	19
curl/lib/curlx/strdup.c	5
curl/lib/vtls/vtls_config.c	13
curl/lib/sigpipe.h	4
curl/lib/ptrarray.c	8
curl/lib/u8_strset.c	6
curl/lib/bufref.c	6
curl/lib/getinfo.c	3
curl/lib/netrc.c	44
curl/lib/setopt.c	5
curl/lib/vdns/dnscache.c	45
curl/lib/multi_ntfy.c	12
curl/lib/uint-bset.c	8
curl/lib/vtls/vtls_scache.c	10
curl/lib/socketpair.c	32
curl/lib/curlx/nonblock.c	5
curl/lib/cf-socket.c	6
curl/lib/curlx/wait.c	5
curl/lib/vdns/hostip.c	7
curl/lib/vdns/asyn-thrdd.c	19
curl/lib/thrdqueue.c	26
curl/lib/thrdpool.c	30
curl/lib/llist.c	7
curl/lib/curl_threads.c	7
curl/tests/libtest/lib2453.c	2
curltool_progress.c	11
curl/lib/cw-out.c	28
curl/lib/sendf.c	30
curl/lib/content_encoding.c	15
curl/lib/ws.c	56
curl/lib/curl_trc.c	8
curl/lib/curl_share.c	22
curl/tests/libtest/cli_h2_pausing.c	3
curl/lib/ftplistparser.c	6
curl/tests/libtest/cli_ev_download.c	1
curl/lib/psl.c	8
curl/lib/vdns/asyn-base.c	8
curl/lib/vdns/asyn-ares.c	1
curl/lib/curl_addrinfo.c	13
curl/lib/vdns/doh.c	9
curl/lib/vdns/httpsrr.c	1
curl/lib/urlapi.c	69
curl/lib/cookie.c	95
curl/lib/curl_fopen.c	20
curl/lib/rand.c	13
curl/lib/altsvc.c	44
curl/lib/curlx/inet_pton.c	7
curl/lib/hsts.c	37
curl/lib/slist.c	2
curl/lib/http_digest.c	7
curl/lib/vauth/digest_sspi.c	34
curl/lib/mime.c	8
curl/lib/protocol.c	2
curl/lib/strequal.c	3
curl/lib/idn.c	28
curl/lib/curl_get_line.c	8
curl/lib/parsedate.c	25
curl/lib/strcase.c	3
curl/tests/libtest/lib1560.c	9
curl/lib/curlx/inet_ntop.c	7
curl/lib/vauth/vauth.c	10
curl/lib/proxy.c	46
curl/lib/file.c	2
curl/lib/vtls/vtls.c	5
curl/lib/cf-https-connect.c	13
curl/lib/vdns/cf-dns.c	22
curl/lib/cf-setup.c	6
curl/lib/vssh/libssh.c	187
curl/lib/vssh/libssh2.c	180
curl/lib/curlx/base64.c	5
curl/lib/curlx/warnless.c	3
curl/lib/vssh/vssh.c	19
curl/lib/smtp.c	62
curl/lib/pingpong.c	30
curl/lib/curl_sasl.c	61
curl/lib/vauth/cleartext.c	7
curl/lib/vauth/krb5_sspi.c	30
curl/lib/curl_sspi.c	12
curl/lib/vauth/gsasl.c	9
curl/lib/vauth/ntlm_sspi.c	28
curl/lib/vauth/oauth2.c	5
curl/lib/vauth/cram.c	11
curl/lib/hmac.c	2
curl/lib/strerror.c	7
curl/lib/http2.c	25
curl/lib/u32_ptrset.c	6
curl/lib/ngh2_shim.c	1
curl/lib/cf-recvbuf.c	10
curl/lib/vauth/spnego_sspi.c	28
curl/lib/http_negotiate.c	19
curl/lib/http_ntlm.c	13
curl/lib/vauth/digest.c	2
curl_fuzzer/legacy_fuzzer.cc	5
curltool_operate.c	1
curltool_urlglob.c	43
curl_fuzzer/proto_fuzzer/telnet_scenario.cc	11
curl/docs/examples/websocket.c	4
curl/lib/api.c	1
curl_fuzzer/proto_fuzzer/h2_plan.cc	1
curl_fuzzer/proto_fuzzer/option_model.cc	15
curl_fuzzer/proto_fuzzer/scenario_runner.cc	84
curl_fuzzer/proto_fuzzer/multi_transfer_runner.cc	68
curl_fuzzer/proto_fuzzer/mock_server.cc	28
curl_fuzzer/proto_fuzzer/multi_socket_driver.cc	10
curl_fuzzer/proto_fuzzer/transfer_session.cc	19
curl_fuzzer/proto_fuzzer/tls_websocket_mock_server.cc	2
curl_fuzzer/proto_fuzzer/option_apply.cc	20
curl_fuzzer/proto_fuzzer/telnet_mock_server.cc	1
curl_fuzzer/proto_fuzzer/request_data.cc	1
curl_fuzzer/zstd_contract_shim.cc	9
curl_fuzzer/proto_fuzzer/bounded_anonymous_input_file.cc	1
curl/lib/headers.c	13
curl_fuzzer/proto_fuzzer/api_lifecycle.cc	3