High level conclusions

Fuzzers reach 51.05% of cyclomatic complexity.

Fuzzers reach 46.42% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1318 / 2839

Cyclomatic complexity statically reachable by fuzzers

7188 / 14079

Runtime code coverage of functions

995 / 2839

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-imap-utf7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	574	67.8%
gold	[1:9]	122	14.4%
yellow	[10:29]	11	1.30%
greenyellow	[30:49]	5	0.59%
lawngreen	50+	134	15.8%
All colors	846	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1624	1624	4 : View List ['iostream_pump_stop', 'o_stream_unref', 'i_stream_unref', 'iostream_pump_unref']	1624	1624	iostream_pump_destroy	call site: 00750	/src/dovecot/src/lib/iostream-pump.c:211
676	676	1 : View List ['event_filter_match_source']	676	676	event_want_level	call site: 00159	/src/dovecot/src/lib/event-log.c:322
25	25	1 : View List ['event_find_field_recursive']	25	121	event_add_str	call site: 00151	/src/dovecot/src/lib/lib-event.c:1065
15	15	1 : View List ['random_open_urandom']	37	37	random_read	call site: 00016	/src/dovecot/src/lib/randgen.c:88
14	1652	8 : View List ['str_printfa', 'str_append_data', 'str_append_c', 'mbase64_decode_to_utf8', 'strchr', 'str_append', 'str_len', 'str_truncate']	14	1652	imap_utf7_to_utf8_int	call site: 00719	/src/dovecot/src/lib-imap/imap-utf7.c:306
14	1554	6 : View List ['str_printfa', 'str_len', 'str_truncate', 'str_append_c', 'mbase64_decode_to_utf8', 'strchr']	14	1554	imap_utf7_to_utf8_int	call site: 00727	/src/dovecot/src/lib-imap/imap-utf7.c:334
8	8	2 : View List ['event_copy_parent_defaults', 'event_ref']	8	8	event_create_internal	call site: 00090	/src/dovecot/src/lib/lib-event.c:422
4	4	1 : View List ['i_warning']	6	48	random_init	call site: 00007	/src/dovecot/src/lib/randgen.c:185
4	4	1 : View List ['i_fatal']	4	4	fd_close_on_exec	call site: 00026	/src/dovecot/src/lib/fd-util.c:21
4	4	1 : View List ['i_fatal']	4	4	hostpid_init	call site: 00471	/src/dovecot/src/lib/hostpid.c:35
4	4	1 : View List ['i_fatal']	4	4	lib_signals_ignore_forced	call site: 00679	/src/dovecot/src/lib/lib-signals.c:567
4	4	1 : View List ['i_fatal']	4	4	i_gettimeofday	call site: 00088	/src/dovecot/src/lib/time-util.c:12

Runtime coverage analysis

Covered functions

123

Functions that are reachable but not covered

185

Reachable functions

300

Percentage of reachable functions covered

38.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib-imap/fuzz-imap-utf7.c	1
lib-test/fuzzer.c	3
lib/lib.c	6
lib/failures.c	7
lib/randgen.c	4
lib/fd-util.c	2
lib/./lib.h	1
lib/data-stack.c	17
lib/./malloc-overflow.h	2
lib/bits.c	1
lib/./bits.h	1
lib/lib-event.c	24
lib/mempool-alloconly.c	2
lib/./mempool.h	6
lib/time-util.c	2
lib/strfuncs.c	9
lib/imem.c	1
lib/./array.h	11
lib/buffer.c	18
lib/mempool.c	1
lib/event-log.c	7
lib/event-filter.c	19
lib/wildcard-match.c	4
lib/printf-format-fix.c	5
lib/net.c	4
lib/backtrace-string.c	3
lib/str.c	7
lib/mempool-datastack.c	1
lib/./str.h	6
lib/./strfuncs.h	1
lib/hostpid.c	1
lib/lib-signals.c	15
lib/ioloop.c	19
lib/ioloop-notify-inotify.c	2
lib/ioloop-notify-fd.c	1
lib/istream.c	4
lib/ioloop-epoll.c	5
lib/array.c	3
lib/ioloop-iolist.c	2
lib/iostream.c	2
lib/memarea.c	1
lib-imap/imap-utf7.c	9
lib-imap/../../src/lib/str.h	6
lib-imap/../../src/lib/malloc-overflow.h	1
lib/unichar.c	3
lib/./unichar.h	2
lib-imap/../../src/lib/unichar.h	1
lib/iostream-pump.c	3
lib/ostream.c	3
lib/priorityq.c	7

Fuzzer: fuzz-message-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	554	63.7%
gold	[1:9]	96	11.0%
yellow	[10:29]	26	2.99%
greenyellow	[30:49]	3	0.34%
lawngreen	50+	190	21.8%
All colors	869	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1583	1624	4 : View List ['iostream_pump_stop', 'o_stream_unref', 'i_stream_unref', 'iostream_pump_unref']	1583	1624	iostream_pump_destroy	call site: 00774	/src/dovecot/src/lib/iostream-pump.c:211
676	676	1 : View List ['event_filter_match_source']	676	676	event_want_level	call site: 00159	/src/dovecot/src/lib/event-log.c:322
33	33	1 : View List ['i_stream_seek']	71	78	i_stream_read_memarea	call site: 00716	/src/dovecot/src/lib/istream.c:344
25	25	1 : View List ['event_find_field_recursive']	25	121	event_add_str	call site: 00151	/src/dovecot/src/lib/lib-event.c:1065
16	16	2 : View List ['i_stream_read_bytes.295', 'i_panic']	16	437	message_parse_header_next	call site: 00000	/src/dovecot/src/lib-mail/message-header-parser.c:229
16	16	2 : View List ['i_panic', 'i_stream_get_name']	16	16	i_stream_default_snapshot	call site: 00000	/src/dovecot/src/lib/istream.c:229
15	15	1 : View List ['random_open_urandom']	37	37	random_read	call site: 00016	/src/dovecot/src/lib/randgen.c:88
12	12	1 : View List ['i_stream_get_data_size']	12	12	parse_next_header	call site: 00000	/src/dovecot/src/lib-mail/message-parser.c:631
10	10	1 : View List ['i_stream_init_parent']	10	13	i_stream_create	call site: 00685	/src/dovecot/src/lib/istream.c:1250
8	8	2 : View List ['event_copy_parent_defaults', 'event_ref']	8	8	event_create_internal	call site: 00090	/src/dovecot/src/lib/lib-event.c:422
6	6	1 : View List ['i_unreached']	6	6	i_stream_unref	call site: 00564	/src/dovecot/src/lib/istream.c:71
4	4	1 : View List ['i_warning']	6	48	random_init	call site: 00007	/src/dovecot/src/lib/randgen.c:185

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

168

Reachable functions

311

Percentage of reachable functions covered

45.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib-mail/fuzz-message-parser.c	1
lib-test/fuzzer.c	2
lib/lib.c	6
lib/failures.c	7
lib/randgen.c	4
lib/fd-util.c	2
lib/./lib.h	1
lib/data-stack.c	17
lib/./malloc-overflow.h	2
lib/bits.c	1
lib/./bits.h	1
lib/lib-event.c	24
lib/mempool-alloconly.c	2
lib/./mempool.h	6
lib/time-util.c	2
lib/strfuncs.c	9
lib/imem.c	1
lib/./array.h	11
lib/buffer.c	17
lib/mempool.c	1
lib/event-log.c	7
lib/event-filter.c	19
lib/wildcard-match.c	4
lib/printf-format-fix.c	5
lib/net.c	4
lib/backtrace-string.c	3
lib/str.c	7
lib/mempool-datastack.c	1
lib/./str.h	6
lib/./strfuncs.h	1
lib/hostpid.c	1
lib/lib-signals.c	15
lib/ioloop.c	19
lib/ioloop-notify-inotify.c	2
lib/ioloop-notify-fd.c	1
lib/istream.c	17
lib/ioloop-epoll.c	5
lib/array.c	3
lib/ioloop-iolist.c	2
lib/iostream.c	4
lib/memarea.c	2
lib-test/test-istream.c	1
lib-test/../../src/lib/malloc-overflow.h	1
lib-test/../../src/lib/mempool.h	1
lib-mail/message-parser.c	9
lib-mail/../../src/lib/malloc-overflow.h	1
lib-mail/../../src/lib/mempool.h	2
lib-mail/../../src/lib/array.h	6
lib-mail/../../src/lib/istream.h	1
lib-mail/message-size.c	1
lib-mail/message-header-parser.c	1
lib/iostream-pump.c	3
lib/ostream.c	3
lib/priorityq.c	7

Fuzzer: fuzz-imap-bodystructure

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	624	49.6%
gold	[1:9]	119	9.47%
yellow	[10:29]	5	0.39%
greenyellow	[30:49]	5	0.39%
lawngreen	50+	503	40.0%
All colors	1256	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1583	1624	4 : View List ['iostream_pump_stop', 'o_stream_unref', 'i_stream_unref', 'iostream_pump_unref']	1583	1624	iostream_pump_destroy	call site: 01161	/src/dovecot/src/lib/iostream-pump.c:211
676	676	1 : View List ['event_filter_match_source']	676	676	event_want_level	call site: 00159	/src/dovecot/src/lib/event-log.c:322
136	684	15 : View List ['imap_parser_read_literal_data', 'imap_parser_skip_to_next', 'imap_parser_open_list', 'imap_parser_is_next_text', 'imap_parser_close_list', 'i_panic', 'imap_parser_read_string', 'i_stream_skip', 'i_unreached', 'is_valid_atom_char', 'imap_parser_read_atom', 'i_stream_get_data', 'imap_parser_read_literal', 'imap_parser_is_next_resp_text', 'imap_parser_read_text']	136	684	imap_parser_read_arg	call site: 00743	/src/dovecot/src/lib-imap/imap-parser.c:645
60	110	3 : View List ['array_append_space_i', 'list_add_ghost_eol', 'array_get_i']	60	110	finish_line	call site: 00814	/src/dovecot/src/lib-imap/imap-parser.c:779
33	33	1 : View List ['i_stream_seek']	71	78	i_stream_read_memarea	call site: 00704	/src/dovecot/src/lib/istream.c:344
25	25	1 : View List ['event_find_field_recursive']	25	121	event_add_str	call site: 00151	/src/dovecot/src/lib/lib-event.c:1065
18	18	1 : View List ['imap_parser_is_next_resp_text']	22	22	imap_parser_read_arg	call site: 00757	/src/dovecot/src/lib-imap/imap-parser.c:694
17	17	1 : View List ['imap_parser_delete_extra_eol']	17	393	imap_parser_read_args	call site: 00732	/src/dovecot/src/lib-imap/imap-parser.c:809
15	15	1 : View List ['random_open_urandom']	37	37	random_read	call site: 00016	/src/dovecot/src/lib/randgen.c:88
10	92	4 : View List ['i_stream_snapshot_free', 'memarea_unref', 'i_stream_unref', 'p_free_internal.708']	10	92	i_stream_snapshot_free	call site: 00564	/src/dovecot/src/lib/istream.c:262
10	10	1 : View List ['i_stream_init_parent']	10	13	i_stream_create	call site: 00692	/src/dovecot/src/lib/istream.c:1250
10	10	1 : View List ['memarea_unref']	10	10	i_stream_free_buffer	call site: 00709	/src/dovecot/src/lib/istream.c:453

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

189

Reachable functions

390

Percentage of reachable functions covered

51.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib-imap/fuzz-imap-bodystructure.c	6
lib-test/fuzzer.c	3
lib/lib.c	6
lib/failures.c	7
lib/randgen.c	4
lib/fd-util.c	2
lib/./lib.h	1
lib/data-stack.c	19
lib/./malloc-overflow.h	2
lib/bits.c	1
lib/./bits.h	1
lib/lib-event.c	24
lib/mempool-alloconly.c	2
lib/./mempool.h	6
lib/time-util.c	2
lib/strfuncs.c	13
lib/imem.c	1
lib/./array.h	11
lib/buffer.c	19
lib/mempool.c	1
lib/event-log.c	7
lib/event-filter.c	19
lib/wildcard-match.c	4
lib/printf-format-fix.c	5
lib/net.c	4
lib/backtrace-string.c	3
lib/str.c	7
lib/mempool-datastack.c	1
lib/./str.h	6
lib/./strfuncs.h	1
lib/hostpid.c	1
lib/lib-signals.c	15
lib/ioloop.c	19
lib/ioloop-notify-inotify.c	2
lib/ioloop-notify-fd.c	1
lib/istream.c	19
lib/ioloop-epoll.c	5
lib/array.c	3
lib/ioloop-iolist.c	2
lib/iostream.c	5
lib/memarea.c	2
lib-imap/imap-bodystructure.c	14
lib/istream-data.c	1
lib-imap/imap-parser.c	24
lib-imap/../../src/lib/malloc-overflow.h	1
lib-imap/../../src/lib/mempool.h	3
lib-imap/../../src/lib/array.h	7
lib-imap/../../src/lib/lib.h	1
lib/strescape.c	1
lib/ostream.c	9
lib-imap/imap-arg.c	6
lib/strnum.c	4
lib-imap/imap-envelope.c	5
lib-imap/../../src/lib/str.h	5
lib-imap/imap-quote.c	7
lib-mail/message-part.c	2
lib/iostream-pump.c	3
lib/priorityq.c	7

Fuzzer: fuzz-json-istream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	736	56.9%
gold	[1:9]	92	7.11%
yellow	[10:29]	8	0.61%
greenyellow	[30:49]	1	0.07%
lawngreen	50+	456	35.2%
All colors	1293	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1583	1624	4 : View List ['iostream_pump_stop', 'o_stream_unref', 'i_stream_unref', 'iostream_pump_unref']	1583	1624	iostream_pump_destroy	call site: 01197	/src/dovecot/src/lib/iostream-pump.c:211
757	757	1 : View List ['json_parser_callback_string_stream']	757	757	json_parser_do_parse_value	call site: 01087	/src/dovecot/src/lib-json/json-parser.c:1973
713	754	2 : View List ['json_string_stream_create', 'i_stream_unref']	713	962	json_parser_callback_string_value	call site: 01109	/src/dovecot/src/lib-json/json-parser.c:543
420	469	9 : View List ['i_stream_have_bytes_left', 'i_stream_get_name', 'i_panic', 'i_stream_skip', 'json_istream_set_error', 'json_istream_consumed_value_stream', 'i_stream_get_error', 'i_stream_read_more', 'i_stream_seek']	420	469	json_istream_consume_value_stream	call site: 00745	/src/dovecot/src/lib-json/json-istream.c:743
107	107	4 : View List ['json_node_is_singular.132', 'i_panic', 'json_node_is_end', 'json_tree_node_add']	107	1533	json_istream_read_tree	call site: 00702	/src/dovecot/src/lib-json/json-istream.c:939
33	33	1 : View List ['i_stream_seek']	71	78	i_stream_read_memarea	call site: 00794	/src/dovecot/src/lib/istream.c:344
16	16	2 : View List ['i_stream_get_error', 'i_stream_get_name']	16	696	json_parser_continue	call site: 01159	/src/dovecot/src/lib-json/json-parser.c:2215
16	16	2 : View List ['i_panic', 'i_stream_get_name']	16	16	i_stream_default_snapshot	call site: 00000	/src/dovecot/src/lib/istream.c:229
15	15	1 : View List ['random_open_urandom']	37	37	random_read	call site: 00016	/src/dovecot/src/lib/randgen.c:88
12	2510	5 : View List ['json_parser_parse_value', 'i_unreached', 'json_parser_curchar', 'json_parser_shift', 'json_parser_skip_ws']	12	3870	json_parser_parse_text	call site: 00866	/src/dovecot/src/lib-json/json-parser.c:2111
10	10	1 : View List ['i_stream_init_parent']	10	13	i_stream_create	call site: 00685	/src/dovecot/src/lib/istream.c:1250
10	10	2 : View List ['i_unreached', 'i_panic']	10	10	json_istream_parse_list_close	call site: 00000	/src/dovecot/src/lib-json/json-istream.c:307

Runtime coverage analysis

Covered functions

216

Functions that are reachable but not covered

218

Reachable functions

404

Percentage of reachable functions covered

46.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib-json/fuzz-json-istream.c	1
lib-test/fuzzer.c	2
lib/lib.c	6
lib/failures.c	7
lib/randgen.c	4
lib/fd-util.c	2
lib/./lib.h	1
lib/data-stack.c	17
lib/./malloc-overflow.h	2
lib/bits.c	1
lib/./bits.h	1
lib/lib-event.c	24
lib/mempool-alloconly.c	2
lib/./mempool.h	6
lib/time-util.c	2
lib/strfuncs.c	10
lib/imem.c	2
lib/./array.h	11
lib/buffer.c	18
lib/mempool.c	1
lib/event-log.c	7
lib/event-filter.c	19
lib/wildcard-match.c	4
lib/printf-format-fix.c	5
lib/net.c	4
lib/backtrace-string.c	3
lib/str.c	7
lib/mempool-datastack.c	1
lib/./str.h	6
lib/./strfuncs.h	1
lib/hostpid.c	1
lib/lib-signals.c	15
lib/ioloop.c	19
lib/ioloop-notify-inotify.c	2
lib/ioloop-notify-fd.c	1
lib/istream.c	26
lib/ioloop-epoll.c	5
lib/array.c	3
lib/ioloop-iolist.c	2
lib/iostream.c	6
lib/memarea.c	2
lib-test/test-istream.c	1
lib-test/../../src/lib/malloc-overflow.h	1
lib-test/../../src/lib/mempool.h	1
lib-json/json-istream.c	13
lib-json/../../src/lib/malloc-overflow.h	1
lib-json/../../src/lib/mempool.h	4
lib-json/json-parser.c	52
lib-json/../../src/lib/array.h	5
lib-json/./json-types.h	2
lib-json/json-tree.c	9
lib-json/../../src/lib/lib.h	1
lib-json/../../src/lib/istream.h	2
lib/unichar.c	3
lib/./unichar.h	2
lib-json/./json-syntax.h	4
lib-json/../../src/lib/str.h	5
lib-json/../../src/lib/unichar.h	2
lib/iostream-pump.c	3
lib/ostream.c	3
lib/priorityq.c	7

Fuzzer: fuzz-smtp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2951	59.3%
gold	[1:9]	110	2.21%
yellow	[10:29]	15	0.30%
greenyellow	[30:49]	11	0.22%
lawngreen	50+	1889	37.9%
All colors	4976	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3794	3794	1 : View List ['smtp_server_connection_ssl_init']	5826	15890	smtp_server_connection_input	call site: 00000	/src/dovecot/src/lib-smtp/smtp-server-connection.c:619
2512	4629	11 : View List ['smtp_params_mail_parse_auth', 'strcmp', 'str_array_icase_find', 'smtp_params_mail_parse_size', 'smtp_params_mail_parse_envid', 'smtp_param_parse', 'smtp_params_mail_parse_body', 't_str_ucase', 'pool_datastack_create', 'smtp_params_mail_parse_ret', 'smtp_params_mail_add_extra']	2512	4629	smtp_params_mail_parse	call site: 03679	/src/dovecot/src/lib-smtp/smtp-params.c:562
2465	7940	28 : View List ['smtp_server_command_unref', 'str_to_uint', 'p_malloc.2082', 'strcmp', 'connection_is_valid_dns_name', 'array_is_created_i.2078', 'smtp_helo_domain_parse', 'smtp_param_parse', 'smtp_server_command_input_lock', 'smtp_server_command_ref', 't_str_ucase', 'pool_datastack_create', 'cmd_xclient_check_state', 'smtp_server_command_add_hook', 'p_strdup', 'net_addr2ip', 'array_get_i.2077', 'net_str2port', 'str_begins_builtin_success.2079', 'smtp_xtext_parse', 'smtp_server_connection_is_trusted', 'smtp_server_connection_set_state', 't_strsplit', 'str_begins_icase', 'malloc_multiply_check.2080', 'strncasecmp', 'smtp_server_cmd_xclient_extra_field', 'strcasecmp']	2465	21737	smtp_server_cmd_xclient	call site: 04417	/src/dovecot/src/lib-smtp/smtp-server-cmd-xclient.c:101
2031	2031	2 : View List ['o_stream_get_disconnect_reason', 'smtp_server_connection_handle_output_error']	2707	4059	smtp_server_reply_send_real	call site: 01845	/src/dovecot/src/lib-smtp/smtp-server-reply.c:638
1537	2461	7 : View List ['cmd_auth_check_state', 'p_malloc.1812', 't_strsplit', 'smtp_server_command_input_lock', 'malloc_multiply_check.1810', 'smtp_server_command_add_hook', 'p_strdup']	1537	5527	smtp_server_cmd_auth	call site: 01595	/src/dovecot/src/lib-smtp/smtp-server-cmd-auth.c:195
1533	2243	2 : View List ['smtp_server_reply_index', 'smtp_address_encode']	1533	2243	smtp_server_recipient_replyv	call site: 04060	/src/dovecot/src/lib-smtp/smtp-server-recipient.c:211
1417	1417	2 : View List ['event_reason_begin', 'event_reason_code']	1417	1417	smtp_server_connection_reason_begin	call site: 03758	/src/dovecot/src/lib-smtp/smtp-server-connection.c:1768
1377	1377	4 : View List ['writev', 'o_stream_lseek', 'o_stream_get_error', 't_strdup']	1381	1381	o_stream_file_writev	call site: 00000	/src/dovecot/src/lib/ostream-file.c:165
1333	1333	1 : View List ['smtp_server_connection_handle_output_error']	1333	1333	smtp_server_connection_flush	call site: 01649	/src/dovecot/src/lib-smtp/smtp-server-connection.c:764
1145	2543	8 : View List ['strcmp', 'smtp_params_rcpt_add_extra', 'str_array_icase_find', 'smtp_params_rcpt_parse_orcpt', 'smtp_param_parse', 't_str_ucase', 'pool_datastack_create', 'smtp_params_rcpt_parse_notify']	1145	2543	smtp_params_rcpt_parse	call site: 03849	/src/dovecot/src/lib-smtp/smtp-params.c:1147
992	992	2 : View List ['iostream_rawlog_create', 'stat']	992	992	smtp_server_connection_update_rawlog	call site: 01672	/src/dovecot/src/lib-smtp/smtp-server-connection.c:154
776	776	1 : View List ['io_loop_notify_handler_deinit']	1517	2421	io_loop_destroy	call site: 04934	/src/dovecot/src/lib/ioloop.c:881

Runtime coverage analysis

Covered functions

764

Functions that are reachable but not covered

585

Reachable functions

1217

Percentage of reachable functions covered

51.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
lib-smtp/fuzz-smtp-server.c	2
lib-test/fuzzer.c	4
lib/lib.c	8
lib/failures.c	8
lib/randgen.c	4
lib/fd-util.c	4
lib/./lib.h	1
lib/data-stack.c	22
lib/./malloc-overflow.h	2
lib/bits.c	1
lib/./bits.h	1
lib/lib-event.c	46
lib/mempool-alloconly.c	2
lib/./mempool.h	7
lib/time-util.c	5
lib/strfuncs.c	39
lib/imem.c	5
lib/./array.h	12
lib/buffer.c	21
lib/mempool.c	2
lib/event-log.c	9
lib/event-filter.c	33
lib/wildcard-match.c	6
lib/printf-format-fix.c	5
lib/net.c	26
lib/backtrace-string.c	3
lib/str.c	8
lib/mempool-datastack.c	1
lib/./str.h	8
lib/./strfuncs.h	3
lib/hostpid.c	2
lib/lib-signals.c	15
lib/ioloop.c	54
lib/ioloop-notify-inotify.c	2
lib/ioloop-notify-fd.c	1
lib/istream.c	25
lib/ioloop-epoll.c	6
lib/array.c	9
lib/ioloop-iolist.c	2
lib/iostream.c	11
lib/memarea.c	2
lib/priorityq.c	12
lib/istream-data.c	1
lib/ostream-file.c	5
lib/ostream.c	32
lib/iostream-pump.c	10
lib-smtp/smtp-server.c	3
lib-smtp/../../src/lib/malloc-overflow.h	2
lib-smtp/../../src/lib/mempool.h	4
lib/./lib-event-private.h	1
lib-smtp/./smtp-common.h	1
lib-smtp/smtp-server-connection.c	54
lib/connection.c	23
lib-smtp/smtp-server-command.c	30
lib-smtp/../../src/lib/array.h	9
lib-smtp/smtp-server-cmd-helo.c	7
lib-smtp/smtp-server-reply.c	24
lib-smtp/../../src/lib/str.h	7
lib-ssl-iostream/iostream-ssl.c	18
lib-smtp/smtp-server-transaction.c	10
lib-smtp/smtp-server-recipient.c	16
lib-smtp/smtp-address.c	16
lib-smtp/./smtp-address.h	2
lib-smtp/./smtp-parser.h	7
lib-smtp/smtp-params.c	27
lib/str-sanitize.c	4
lib/unichar.c	6
lib/./unichar.h	2
lib-smtp/smtp-command-parser.c	7
lib/safe-memset.c	1
lib/./buffer.h	1
lib-smtp/./smtp-server-private.h	1
lib-smtp/smtp-reply-parser.c	1
lib-smtp/smtp-reply.c	4
lib-smtp/./smtp-reply.h	1
lib-smtp/smtp-syntax.c	4
lib-smtp/smtp-parser.c	12
lib/strnum.c	17
lib-smtp/smtp-server-cmd-auth.c	4
lib-smtp/smtp-server-cmd-starttls.c	5
lib/iostream-rawlog.c	5
lib/istream-rawlog.c	2
lib/ostream-rawlog.c	2
lib/./time-util.h	3
lib-smtp/../../src/lib/ostream.h	1
lib-ssl-iostream/ssl-settings.c	3
lib-settings/settings.c	51
lib-settings/../../src/lib/str.h	5
lib-settings/settings-parser.c	31
lib-settings/../../src/lib/malloc-overflow.h	1
lib-settings/../../src/lib/mempool.h	4
lib-settings/../../src/lib/lib.h	1
lib-settings/../../src/lib/array.h	13
lib-settings/../../src/lib/strfuncs.h	2
lib/hash.c	19
lib/event-filter-lexer.c	17
lib/event-filter-lexer.l	4
lib/event-filter-parser.c	5
lib/event-filter-parser.y	3
lib/strescape.c	3
lib/str-parse.c	5
lib-var-expand/expansion-program.c	9
lib-var-expand/../../src/lib/malloc-overflow.h	1
lib-var-expand/../../src/lib/mempool.h	4
lib-var-expand/../../src/lib/array.h	6
lib-var-expand/var-expand-lexer.c	17
lib-var-expand/var-expand-lexer.l	6
lib-var-expand/var-expand-parser.c	5
lib-var-expand/../../src/lib/str.h	7
lib-var-expand/../../src/lib/lib.h	1
lib-var-expand/var-expand-parser.y	7
lib-var-expand/expansion-statement.c	1
lib-var-expand/var-expand.c	10
lib-var-expand/expansion-filter.c	1
lib/hex-binary.c	2
lib-settings/./settings-parser.h	1
lib/read-full.c	1
lib-ssl-iostream/../../src/lib/mempool.h	3
lib-ssl-iostream/../../src/lib/malloc-overflow.h	1
lib-ssl-iostream/iostream-ssl-context-cache.c	5
lib/primes.c	1
lib/module-dir.c	23
lib-smtp/smtp-server-cmd-mail.c	5
lib-smtp/../../src/lib/strfuncs.h	1
lib-smtp/../../src/lib/lib.h	1
lib-smtp/smtp-server-cmd-rcpt.c	7
lib-mail/message-address.c	16
lib-mail/rfc822-parser.c	10
lib-mail/../../src/lib/str.h	5
lib-mail/../../src/lib/malloc-overflow.h	1
lib-mail/../../src/lib/mempool.h	1
lib-mail/../../src/lib/lib.h	1
lib-mail/./rfc822-parser.h	1
lib-smtp/smtp-server-cmd-data.c	21
lib-mail/istream-dot.c	1
lib/istream-failure-at.c	1
lib/istream-chain.c	4
lib/istream-limit.c	1
lib/istream-sized.c	3
lib-smtp/smtp-server-cmd-rset.c	3
lib-smtp/smtp-server-cmd-vrfy.c	2
lib-smtp/smtp-server-cmd-noop.c	2
lib-smtp/smtp-server-cmd-quit.c	1
lib-smtp/smtp-server-cmd-xclient.c	5
lib-smtp/./smtp-command.h	1
lib/guid.c	2
lib/sha1.c	6
lib-smtp/../../src/lib/base64.h	3
lib/base64.c	4
lib/istream-unix.c	1
lib/istream-file.c	2
lib/ostream-unix.c	1
lib/sleep.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
parse_next_mime_header_init	/src/dovecot/src/lib-mail/message-parser.c	2	['N/A', 'N/A']	18	0	29	3	2	246	0	1189	324
smtp_server_connection_input	/src/dovecot/src/lib-smtp/smtp-server-connection.c	1	['N/A']	39	0	441	77	25	832	0	4127	187
restrict_access_by_env	/src/dovecot/src/lib/restrict-access.c	2	['int', 'N/A']	31	0	55	9	4	215	0	893	171
settings_read	/src/dovecot/src/lib-settings/settings.c	8	['N/A', 'int', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'N/A']	21	0	153	15	5	290	0	1368	170
json_istream_walk_stream	/src/dovecot/src/lib-json/json-istream.c	5	['N/A', 'size_t', 'size_t', 'N/A', 'N/A']	27	0	138	20	9	337	0	1482	153
o_stream_file_send_istream	/src/dovecot/src/lib/ostream-file.c	2	['N/A', 'N/A']	33	0	156	23	10	234	0	1009	150
event_minimize	/src/dovecot/src/lib/lib-event.c	1	['N/A']	34	0	225	43	16	225	0	938	121

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1494 / 2839

Cyclomatic complexity statically reachable by fuzzers

8414 / 14079

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

lib-imap/fuzz-imap-utf7.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'str_vprintfa', 'fuzzer_deinit', 'i_snprintf', 'printf_format_fix_noalloc', 't_malloc_real', 'event_want_log_level', 'iostream_pump_destroy', 'buffer_check_append_limits']

lib-mail/fuzz-message-parser.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fuzzer_deinit', 'buffer_set_used_size', 'i_snprintf', 'i_stream_snapshot_free', 'str_truncate', 'lib_signals_init', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'event_want_log_level']

lib-imap/fuzz-imap-bodystructure.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['io_stream_free', 'fuzzer_deinit', 'i_snprintf', 'str_truncate', 'lib_signals_init', 'str_vprintfa', 't_malloc_real', 'p_strdup_vprintf', 'event_want_log_level', 'iostream_pump_destroy']

lib-json/fuzz-json-istream.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fuzzer_deinit', 'buffer_set_used_size', 'i_snprintf', 'array_idx_get_space_i', 'str_truncate', 'buffer_check_limits', 't_malloc_no0', 'p_strdup_vprintf', 'lib_signals_init', 'i_stream_snapshot_free']

lib-smtp/fuzz-smtp-server.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['str_truncate', 'array_get_modifiable_i', 'i_realloc', 'array_create_i', 'array_bsearch_i', 'str_to_uintmax', 'array_clear_i', 'smtp_server_cmd_xclient']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
json_istream_read_tree	59	29	49.15%	['fuzz-json-istream']
json_istream_parse_list_open	57	27	47.36%	['fuzz-json-istream']
json_istream_parse_list_close	52	23	44.23%	['fuzz-json-istream']
json_istream_parse_value	51	23	45.09%	['fuzz-json-istream']
json_istream_consume_value_stream	33	8	24.24%	['fuzz-json-istream']
json_parser_callback_string_value	42	16	38.09%	['fuzz-json-istream']
json_tree_node_add_value	43	20	46.51%	['fuzz-json-istream']
smtp_server_cmd_auth	43	12	27.90%	['fuzz-smtp-server']
smtp_server_cmd_xclient	136	12	8.823%	['fuzz-smtp-server']
smtp_server_connection_input	68	28	41.17%	['fuzz-smtp-server']
smtp_server_connection_alloc	133	25	18.79%	['fuzz-smtp-server']
smtp_server_reply_update_prefix	44	17	38.63%	['fuzz-smtp-server']
base64_encode_finish	112	55	49.10%	['fuzz-smtp-server']
base64_encode_get_out_size	35	17	48.57%	['fuzz-smtp-server']
base64_encode_more_data	132	56	42.42%	['fuzz-smtp-server']
io_loop_destroy	83	28	33.73%	['fuzz-json-istream', 'fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-smtp-server', 'fuzz-imap-bodystructure']
i_stream_failure_at_read	34	14	41.17%	['fuzz-smtp-server']
i_stream_file_read	66	32	48.48%	['fuzz-smtp-server']
o_stream_file_writev	60	21	35.0%	['fuzz-smtp-server']
o_stream_file_writev_full	72	26	36.11%	['fuzz-smtp-server']
t_str_oneline	41	7	17.07%	['fuzz-smtp-server']
split_str_slow	40	20	50.0%	['fuzz-smtp-server']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dovecot/src/lib/ostream-rawlog.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/lib-signals.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/iostream-rawlog.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/mempool-alloconly.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-reply.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/memarea.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-message-parser', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/str.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/istream-rawlog.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/ostream.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-json/json-istream.c	['fuzz-json-istream']	['fuzz-json-istream']
/src/dovecot/src/lib-settings/settings.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/istream-failure-at.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/array.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-message-parser', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-imap/imap-envelope.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib/event-filter-lexer.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/istream-seekable.c	[]	[]
/src/dovecot/src/lib/event-log.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-smtp-server']
/src/dovecot/src/lib/sha2.c	[]	[]
/src/dovecot/src/lib-smtp/smtp-server-recipient.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/istream-data.c	['fuzz-imap-bodystructure', 'fuzz-smtp-server']	['fuzz-imap-bodystructure', 'fuzz-smtp-server']
/src/dovecot/src/lib-mail/../../src/lib/strfuncs.h	[]	[]
/src/dovecot/src/lib-smtp/smtp-server-transaction.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-mail/message-header-parser.c	['fuzz-message-parser']	['fuzz-message-parser']
/src/dovecot/src/lib-mail/./rfc822-parser.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/str-sanitize.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-imap/imap-bodystructure.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib-mail/message-date.c	[]	[]
/src/dovecot/src/lib/istream-limit.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-parser.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-mail/message-size.c	['fuzz-message-parser']	['fuzz-message-parser']
/src/dovecot/src/lib-var-expand/var-expand-lexer.l	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/punycode.c	[]	[]
/src/dovecot/src/lib-imap/fuzz-imap-bodystructure.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib-mail/message-parser.c	['fuzz-message-parser']	['fuzz-message-parser']
/src/dovecot/src/lib/sendfile-util.c	[]	[]
/src/dovecot/src/lib/sleep.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-imap/imap-parser.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib-var-expand/var-expand-parser.y	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-json/json-tree.c	['fuzz-json-istream']	['fuzz-json-istream']
/src/dovecot/src/lib-var-expand/var-expand-lexer.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/priorityq.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/backtrace-string.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server-reply.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-mail/fuzz-message-parser.c	['fuzz-message-parser']	['fuzz-message-parser']
/src/dovecot/src/lib/lib-event.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/net.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-var-expand/../../src/lib/byteorder.h	[]	[]
/src/dovecot/src/lib/cpu-count.c	[]	[]
/src/dovecot/src/lib/module-dir.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/event-filter-parser.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-imap/imap-arg.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib/md4.c	[]	[]
/src/dovecot/src/lib/istream-file.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/md5.c	[]	[]
/src/dovecot/src/lib-smtp/../../src/lib/str.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/safe-mkstemp.c	[]	[]
/src/dovecot/src/lib/utc-mktime.c	[]	[]
/src/dovecot/src/lib/iostream-pump.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-test/fuzzer.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-ssl-iostream/ssl-settings.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-test/test-istream.c	['fuzz-message-parser', 'fuzz-json-istream']	['fuzz-message-parser', 'fuzz-json-istream']
/src/dovecot/src/lib/./unichar.h	['fuzz-imap-utf7', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib/read-full.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-dns/./dns-util.h	[]	[]
/src/dovecot/src/lib/fd-util.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-server-cmd-rcpt.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/../../src/lib/base64.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/ioloop-epoll.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/./buffer.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/istream-concat.c	[]	[]
/src/dovecot/src/lib/./time-util.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/mempool-datastack.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-smtp-server']
/src/dovecot/src/lib/event-filter-parser.y	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/process-title.c	[]	[]
/src/dovecot/src/lib-json/./json-syntax.h	['fuzz-json-istream']	[]
/src/dovecot/src/lib/connection.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/sha1.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-var-expand/var-expand-parser.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/./lib.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-imap/../../src/lib/mempool.h	['fuzz-imap-bodystructure']	[]
/src/dovecot/src/lib-smtp/smtp-server-cmd-mail.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/./smtp-command.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-settings/settings-parser.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/write-full.c	[]	[]
/src/dovecot/src/lib/./mempool.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server-cmd-quit.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-server-cmd-vrfy.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/bits.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/./smtp-parser.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/fuzz-smtp-server.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/utc-offset.c	[]	[]
/src/dovecot/src/lib/buffer.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/./array.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib/event-filter.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/./str.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib/restrict-access.c	[]	[]
/src/dovecot/src/lib-var-expand/var-expand.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/ostream-unix.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/env-util.c	[]	[]
/src/dovecot/src/lib/rand.c	[]	[]
/src/dovecot/src/lib/ostream-file.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-server-cmd-data.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-server-cmd-xclient.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/ioloop-notify-inotify.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-var-expand/expansion-statement.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/lib.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-json/../../src/lib/unichar.h	['fuzz-json-istream']	[]
/src/dovecot/src/lib/unichar.c	['fuzz-imap-utf7', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-var-expand/./var-expand.h	[]	[]
/src/dovecot/src/lib-json/json-parser.c	['fuzz-json-istream']	['fuzz-json-istream']
/src/dovecot/src/lib-var-expand/expansion-parameter.c	[]	[]
/src/dovecot/src/lib/hex-binary.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/istream-chain.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-imap/imap-utf7.c	['fuzz-imap-utf7']	['fuzz-imap-utf7']
/src/dovecot/src/lib/./malloc-overflow.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server-cmd-helo.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/imem.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-server-cmd-starttls.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-json/./json-tree.h	[]	[]
/src/dovecot/src/lib-var-expand/expansion-filter.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/hash.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-var-expand/../../src/lib/strfuncs.h	[]	[]
/src/dovecot/src/lib-mail/rfc822-parser.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/sha3.c	[]	[]
/src/dovecot/src/lib/safe-memset.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/./smtp-common.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/path-util.c	[]	[]
/src/dovecot/src/lib/iostream.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/eacces-error.c	[]	[]
/src/dovecot/src/lib/strnum.c	['fuzz-imap-bodystructure', 'fuzz-smtp-server']	['fuzz-imap-bodystructure', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/../../src/lib/ostream.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-var-expand/expansion-program.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server-command.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/randgen.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-imap/imap-quote.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib-mail/message-address.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/fdpass.c	[]	[]
/src/dovecot/src/lib-mail/istream-dot.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-address.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-mail/rfc2231-parser.c	[]	[]
/src/dovecot/src/lib-smtp/smtp-server-cmd-rset.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-command-parser.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-ssl-iostream/iostream-ssl.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/hash-method.c	[]	[]
/src/dovecot/src/lib-var-expand/../../src/lib/array.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/guid.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/./smtp-address.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/./lib-event-private.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/ioloop-iolist.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-syntax.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/strfuncs.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/failures.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-json/fuzz-json-istream.c	['fuzz-json-istream']	['fuzz-json-istream']
/src/dovecot/src/lib/./base64.h	[]	[]
/src/dovecot/src/lib/printf-format-fix.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/istream.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-charset/charset-utf8.c	[]	[]
/src/dovecot/src/lib-charset/charset-iconv.c	[]	[]
/src/dovecot/src/lib/wildcard-match.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-params.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib-ssl-iostream/iostream-ssl-context-cache.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/./bits.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-imap/fuzz-imap-utf7.c	['fuzz-imap-utf7']	['fuzz-imap-utf7']
/src/dovecot/src/lib-smtp/./smtp-server-private.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-var-expand/expansion-filter-crypt.c	[]	[]
/src/dovecot/src/lib-json/./json-types.h	['fuzz-json-istream']	[]
/src/dovecot/src/lib/strescape.c	['fuzz-imap-bodystructure', 'fuzz-smtp-server']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib/event-filter-lexer.l	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/smtp-server-connection.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/str-parse.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/time-util.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/smtp-common.c	[]	[]
/src/dovecot/src/lib/ioloop-notify-fd.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib-settings/./settings-parser.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib/mempool-unsafe-datastack.c	[]	[]
/src/dovecot/src/lib-dns/dns-util.c	[]	[]
/src/dovecot/src/lib/crc32.c	[]	[]
/src/dovecot/src/lib-smtp/smtp-server-cmd-auth.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/data-stack.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-mail/message-part.c	['fuzz-imap-bodystructure']	['fuzz-imap-bodystructure']
/src/dovecot/src/lib-smtp/smtp-server-cmd-noop.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/./istream.h	[]	[]
/src/dovecot/src/lib/base64.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/istream-sized.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/mmap-util.c	[]	[]
/src/dovecot/src/lib/ioloop.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-smtp/./smtp-syntax.h	[]	[]
/src/dovecot/src/lib/mempool-system.c	[]	[]
/src/dovecot/src/lib/ipwd.c	[]	[]
/src/dovecot/src/lib/hostpid.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib/mempool.c	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']
/src/dovecot/src/lib-var-expand/expansion-filter-if.c	[]	[]
/src/dovecot/src/lib/./strfuncs.h	['fuzz-imap-utf7', 'fuzz-message-parser', 'fuzz-imap-bodystructure', 'fuzz-json-istream', 'fuzz-smtp-server']	[]
/src/dovecot/src/lib/istream-unix.c	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/./smtp-reply.h	['fuzz-smtp-server']	[]
/src/dovecot/src/lib-smtp/./smtp-params.h	[]	[]
/src/dovecot/src/lib-smtp/smtp-reply-parser.c	['fuzz-smtp-server']	['fuzz-smtp-server']
/src/dovecot/src/lib/primes.c	['fuzz-smtp-server']	[]

Directories in report

Directory
/src/dovecot/src/lib-ssl-iostream/
/src/dovecot/src/lib-var-expand/../../src/lib/
/src/dovecot/src/lib-test/
/src/dovecot/src/lib-var-expand/
/src/dovecot/src/lib-smtp/
/src/dovecot/src/lib-settings/
/src/dovecot/src/lib-mail/./
/src/dovecot/src/lib-imap/../../src/lib/
/src/dovecot/src/lib-smtp/../../src/lib/
/src/dovecot/src/lib-settings/./
/src/dovecot/src/lib-charset/
/src/dovecot/src/lib/./
/src/dovecot/src/lib-mail/../../src/lib/
/src/dovecot/src/lib-json/
/src/dovecot/src/lib-var-expand/./
/src/dovecot/src/lib/
/src/dovecot/src/lib-dns/./
/src/dovecot/src/lib-json/../../src/lib/
/src/dovecot/src/lib-smtp/./
/src/dovecot/src/lib-json/./
/src/dovecot/src/lib-mail/
/src/dovecot/src/lib-imap/
/src/dovecot/src/lib-dns/