High level conclusions

Fuzzer fuzz-suite is blocked:

The runtime code coverage of fuzz-suite covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-imap-bodystructure is blocked:

The runtime code coverage of fuzz-imap-bodystructure covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 30.34% of cyclomatic complexity.

Fuzzers reach 28.71% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

3206 / 11164

Cyclomatic complexity statically reachable by fuzzers

18089 / 59613

Runtime code coverage of functions

1610 / 11164

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-imap-bodystructure

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1401	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1401	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1400	0	EP	call site: 00000	imap_bodystructure_parse_full

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

432

Reachable functions

432

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-bodystructure.c	6
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	22
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	13
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	5
dovecotlib/memarea.c	2
dovecotlib-imap/imap-bodystructure.c	14
dovecotlib/istream-data.c	1
dovecotlib-imap/imap-parser.c	24
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	7
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	6
dovecotlib/strnum.c	5
dovecotlib-imap/imap-envelope.c	5
dovecotlib-imap/../..lib/str.h	5
dovecotlib-imap/imap-quote.c	7
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-mail/message-part.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-pointer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	600	61.6%
gold	[1:9]	2	0.20%
yellow	[10:29]	4	0.41%
greenyellow	[30:49]	1	0.10%
lawngreen	50+	367	37.6%
All colors	974	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
58	828	i_close_fd_path	call site: 00828	io_remove
48	291	i_snprintf	call site: 00291	t_push
39	391	buffer_set_used_size	call site: 00391	event_want_level
33	790	iostream_pump_destroy	call site: 00790	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
31	219	p_strdup_vprintf	call site: 00219	event_match_field
28	653	buffer_delete	call site: 00653	signal_shadow
23	167	event_want_level	call site: 00167	event_filter_match_source
22	434	t_memdup_noconst	call site: 00434	event_get_log_message_str_out
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf
15	463	event_unref	call site: 00463	event_send

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

176

Reachable functions

334

Percentage of reachable functions covered

47.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-pointer.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	3
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	6
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-json/json-pointer.c	5
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	2
dovecotlib-json/../..lib/str.h	2
dovecotlib/uri-util.c	7
dovecotlib/./uri-util.h	1
dovecotlib/numpack.c	1
dovecotlib-json/../..lib/lib.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	633	47.1%
gold	[1:9]	2	0.14%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	707	52.6%
All colors	1342	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
48	291	i_snprintf	call site: 00291	t_push
40	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
37	1221	array_idx_i	call site: 01221	t_strdup_printf
33	1164	iostream_pump_destroy	call site: 01164	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
31	219	p_strdup_vprintf	call site: 00219	event_match_field
28	391	buffer_set_used_size	call site: 00391	event_want_level
28	653	buffer_delete	call site: 00653	signal_shadow
23	167	event_want_level	call site: 00167	event_filter_match_source
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf
19	437	str_truncate	call site: 00437	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

337

Functions that are reachable but not covered

176

Reachable functions

444

Percentage of reachable functions covered

60.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	21
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	9
dovecotlib-mail/message-decoder.c	10
dovecotlib-mail/../..lib/base64.h	4
dovecotlib/unichar.c	9
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib/./unichar.h	2
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/rfc822-parser.c	7
dovecotlib-mail/../..lib/str.h	6
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-mail/rfc2231-parser.c	11
dovecotlib/strnum.c	3
dovecotlib-charset/charset-utf8.c	7
dovecotlib-mail/message-address.c	1
dovecotlib-mail/message-header-decode.c	5
dovecotlib-mail/quoted-printable.c	1
dovecotlib/hex-binary.c	1
dovecotlib/base64.c	4
dovecotlib/./base64.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-utf7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	601	62.7%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	355	37.0%
All colors	958	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
65	391	buffer_set_used_size	call site: 00391	event_want_level
58	812	i_close_fd_path	call site: 00812	io_remove
48	291	i_snprintf	call site: 00291	t_push
38	212	printf_format_fix_noalloc	call site: 00212	t_buffer_get
33	774	iostream_pump_destroy	call site: 00774	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
28	653	buffer_delete	call site: 00653	signal_shadow
26	167	event_want_level	call site: 00167	event_filter_match_source
16	362	buffer_check_append_limits	call site: 00362	t_strdup_printf
15	463	event_unref	call site: 00463	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

181

Reachable functions

333

Percentage of reachable functions covered

45.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-utf7.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-imap/imap-utf7.c	9
dovecotlib-imap/../..lib/str.h	6
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib/hex-dec.c	1
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-imap/../..lib/unichar.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-date

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	614	64.4%
gold	[1:9]	4	0.41%
yellow	[10:29]	6	0.62%
greenyellow	[30:49]	5	0.52%
lawngreen	50+	324	33.9%
All colors	953	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
58	807	i_close_fd_path	call site: 00807	io_remove
48	291	i_snprintf	call site: 00291	t_push
44	391	buffer_set_used_size	call site: 00391	event_want_level
38	212	printf_format_fix_noalloc	call site: 00212	t_buffer_get
33	769	iostream_pump_destroy	call site: 00769	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
28	362	buffer_check_append_limits	call site: 00362	t_strdup_printf
28	653	buffer_delete	call site: 00653	signal_shadow
27	167	event_want_level	call site: 00167	event_filter_match_source
19	437	str_truncate	call site: 00437	event_get_log_message_str_out
15	463	event_unref	call site: 00463	event_send

Runtime coverage analysis

Covered functions

158

Functions that are reachable but not covered

185

Reachable functions

330

Percentage of reachable functions covered

43.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-date.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	10
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/message-date.c	4
dovecotlib-mail/rfc822-parser.c	4
dovecotlib-mail/../..lib/str.h	5
dovecotlib/utc-mktime.c	3
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	603	60.0%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	399	39.7%
All colors	1004	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
48	291	i_snprintf	call site: 00291	t_push
40	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
39	391	buffer_set_used_size	call site: 00391	event_want_level
38	878	array_idx_i	call site: 00878	t_strdup_printf
33	821	iostream_pump_destroy	call site: 00821	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
31	219	p_strdup_vprintf	call site: 00219	event_match_field
28	653	buffer_delete	call site: 00653	signal_shadow
23	167	event_want_level	call site: 00167	event_filter_match_source
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf
19	437	str_truncate	call site: 00437	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

272

Functions that are reachable but not covered

171

Reachable functions

347

Percentage of reachable functions covered

50.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	6
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-istream-json-string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	674	68.2%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	311	31.5%
All colors	987	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
58	841	i_close_fd_path	call site: 00841	io_remove
57	291	i_snprintf	call site: 00291	t_push
44	391	buffer_set_used_size	call site: 00391	event_want_level
42	436	str_truncate	call site: 00436	event_get_log_message_str_out
39	151	buffer_check_limits	call site: 00151	event_want_level
33	220	p_strdup_vprintf	call site: 00220	event_match_field
33	803	iostream_pump_destroy	call site: 00803	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
29	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
28	362	buffer_check_append_limits	call site: 00362	t_strdup_printf
28	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
28	653	buffer_delete	call site: 00653	signal_shadow

Runtime coverage analysis

Covered functions

232

Functions that are reachable but not covered

198

Reachable functions

345

Percentage of reachable functions covered

42.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-istream-json-string.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib/istream-data.c	1
dovecotlib-json/istream-json-string.c	2
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	1
dovecotlib-json/json-parser.c	2
dovecotlib-json/../..lib/array.h	2
dovecotlib-json/../..lib/istream.h	2
dovecotlib-json/../..lib/str.h	3
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	746	64.4%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	408	35.2%
All colors	1157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
48	291	i_snprintf	call site: 00291	t_push
38	1034	array_idx_i	call site: 01034	t_strdup_printf
33	977	iostream_pump_destroy	call site: 00977	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
31	219	p_strdup_vprintf	call site: 00219	event_match_field
28	653	buffer_delete	call site: 00653	signal_shadow
28	803	uni_utf8_parse_char	call site: 00803	append_valid_utf8
23	167	event_want_level	call site: 00167	event_filter_match_source
23	391	buffer_set_used_size	call site: 00391	event_want_level
22	434	t_memdup_noconst	call site: 00434	event_get_log_message_str_out
20	884	array_sort_i	call site: 00884	create_literal

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

193

Reachable functions

397

Percentage of reachable functions covered

51.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	23
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	2
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	3
dovecotlib-var-expand/../..lib/array.h	5
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	3
dovecotlib/strnum.c	11
dovecotlib/unichar.c	5
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand-import

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	632	65.0%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	337	34.7%
All colors	971	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
65	391	buffer_set_used_size	call site: 00391	event_want_level
58	825	i_close_fd_path	call site: 00825	io_remove
48	291	i_snprintf	call site: 00291	t_push
38	212	printf_format_fix_noalloc	call site: 00212	t_buffer_get
33	787	iostream_pump_destroy	call site: 00787	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
28	653	buffer_delete	call site: 00653	signal_shadow
27	167	event_want_level	call site: 00167	event_filter_match_source
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf
15	463	event_unref	call site: 00463	event_send
13	764	split_str_fast	call site: 00764	split_str_slow

Runtime coverage analysis

Covered functions

152

Functions that are reachable but not covered

190

Reachable functions

332

Percentage of reachable functions covered

42.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand-import.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	7
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	7
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	2
dovecotlib/strescape.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-qp-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	678	71.4%
gold	[1:9]	2	0.21%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	269	28.3%
All colors	949	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
68	291	i_snprintf	call site: 00291	t_push
58	803	i_close_fd_path	call site: 00803	io_remove
56	422	buffer_copy	call site: 00422	str_vprintfa
43	151	buffer_check_limits	call site: 00151	event_want_level
41	212	printf_format_fix_noalloc	call site: 00212	t_buffer_get
33	765	iostream_pump_destroy	call site: 00765	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
28	362	buffer_check_append_limits	call site: 00362	t_strdup_printf
28	391	buffer_set_used_size	call site: 00391	event_want_level
28	653	buffer_delete	call site: 00653	signal_shadow
23	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

210

Reachable functions

322

Percentage of reachable functions covered

34.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-qp-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib/hex-binary.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-istream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	750	65.5%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	391	34.1%
All colors	1144	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
58	998	i_close_fd_path	call site: 00998	io_remove
57	291	i_snprintf	call site: 00291	t_push
44	391	buffer_set_used_size	call site: 00391	event_want_level
41	437	str_truncate	call site: 00437	event_get_log_message_str_out
39	151	buffer_check_limits	call site: 00151	event_want_level
33	960	iostream_pump_destroy	call site: 00960	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
30	220	p_strdup_vprintf	call site: 00220	event_match_field
29	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
28	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
28	653	buffer_delete	call site: 00653	signal_shadow
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf

Runtime coverage analysis

Covered functions

254

Functions that are reachable but not covered

213

Reachable functions

390

Percentage of reachable functions covered

45.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-istream.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-json/json-istream.c	14
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	4
dovecotlib-json/json-parser.c	14
dovecotlib-json/../..lib/array.h	5
dovecotlib-json/./json-types.h	2
dovecotlib-json/json-tree.c	9
dovecotlib-json/../..lib/lib.h	1
dovecotlib-json/../..lib/istream.h	2
dovecotlib/unichar.c	2
dovecotlib/./unichar.h	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-request-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	677	44.1%
gold	[1:9]	12	0.78%
yellow	[10:29]	18	1.17%
greenyellow	[30:49]	5	0.32%
lawngreen	50+	821	53.5%
All colors	1533	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
48	291	i_snprintf	call site: 00291	t_push
44	391	buffer_set_used_size	call site: 00391	event_want_level
40	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
38	1407	array_idx_i	call site: 01407	t_strdup_printf
33	1351	iostream_pump_destroy	call site: 01351	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
30	220	p_strdup_vprintf	call site: 00220	event_match_field
28	653	buffer_delete	call site: 00653	signal_shadow
23	167	event_want_level	call site: 00167	event_filter_match_source
19	371	buffer_nul_terminate	call site: 00371	t_strdup_printf
19	437	str_truncate	call site: 00437	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

366

Functions that are reachable but not covered

186

Reachable functions

501

Percentage of reachable functions covered

62.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-request-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-request-parser.c	13
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-url.c	14
dovecotlib/uri-util.c	25
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/./http-parser.h	3
dovecotlib-http/../..lib/str.h	5
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib/strnum.c	5
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/./uri-util.h	1
dovecotlib-http/../..lib/uri-util.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-sasl-authentication

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	605	40.0%
gold	[1:9]	13	0.85%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.26%
lawngreen	50+	890	58.8%
All colors	1512	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
48	291	i_snprintf	call site: 00291	t_push
32	254	t_malloc_real	call site: 00254	t_strdup_printf
30	220	p_strdup_vprintf	call site: 00220	event_match_field
29	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
27	540	lib_signals_ioloop_switched	call site: 00540	lib_signals_ioloop_unref
23	167	event_want_level	call site: 00167	event_filter_match_source
22	653	buffer_delete	call site: 00653	signal_shadow
22	1344	priorityq_peek	call site: 01344	t_strdup_printf
20	1404	iostream_pump_destroy	call site: 01404	io_loop_destroy
19	630	array_idx_get_space_i	call site: 00630	signal_read
17	1368	priorityq_deinit	call site: 01368	t_strdup_printf
14	813	i_stream_read_memarea	call site: 00813	i_stream_seek

Runtime coverage analysis

Covered functions

619

Functions that are reachable but not covered

155

Reachable functions

471

Percentage of reachable functions covered

67.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-sasl/fuzz-sasl-authentication.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	12
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	35
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	3
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	21
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib/./lib-event-private.h	1
dovecotlib-auth/password-scheme.c	4
dovecotlib/primes.c	1
dovecotlib-sasl/dsasl-client.c	9
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib/istream-data.c	1
dovecotlib/priorityq.c	8
dovecotlib-sasl/sasl-server.c	4
dovecotlib-sasl/../..lib/mempool.h	2
dovecotlib-sasl/sasl-server-mech-anonymous.c	1
dovecotlib-sasl/sasl-server-mech.c	16
dovecotlib-sasl/sasl-server-mech-cram-md5.c	1
dovecotlib-sasl/sasl-server-mech-digest-md5.c	1
dovecotlib-sasl/sasl-server-mech-login.c	1
dovecotlib-sasl/sasl-server-mech-plain.c	1
dovecotlib-sasl/sasl-server-mech-scram.c	5
dovecotlib-sasl/sasl-server-mech-oauth2.c	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-sasl/sasl-server-request.c	12
dovecotlib-sasl/../..lib/str.h	4
dovecotlib-sasl/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-sasl/../..lib/istream.h	1
dovecotlib-sasl/../..lib/lib.h	1
dovecotlib-sasl/../..lib/buffer.h	1
dovecotlib/safe-memset.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-smtp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3151	60.0%
gold	[1:9]	20	0.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	2072	39.5%
All colors	5244	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
330	3319	array_get_modifiable_i	call site: 03319	smtp_server_connection_sni_callback
210	2275	i_realloc	call site: 02275	settings_instance_overrides_add_filters
167	2998	array_get_i	call site: 02998	settings_parse_keyidx_value_nodup
151	3167	array_delete_i	call site: 03167	settings_sort_filter_array
143	2651	array_create_i	call site: 02651	var_expand_parser_parse
133	2130	array_idx_i	call site: 02130	settings_instance_override_init
125	2524	array_clear_i	call site: 02524	settings_instance_override
117	4033	str_truncate	call site: 04033	message_address_parse_real
113	1732	str_to_uintmax	call site: 01732	smtp_server_connection_output
96	4589	smtp_server_cmd_xclient	call site: 04589	cmd_xclient_recheck
95	2902	str_truncate	call site: 02902	settings_parse_read_file
77	2003	str_truncate	call site: 02003	settings_get

Runtime coverage analysis

Covered functions

801

Functions that are reachable but not covered

616

Reachable functions

1282

Percentage of reachable functions covered

51.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-smtp/fuzz-smtp-server.c	2
dovecotlib-test/fuzzer.c	4
dovecotlib/lib.c	11
dovecotlib/failures.c	10
dovecotlib/randgen.c	7
dovecotlib/hash.c	20
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	48
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	44
dovecotlib/./array.h	12
dovecotlib/imem.c	5
dovecotlib/buffer.c	24
dovecotlib/mempool.c	2
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	34
dovecotlib/wildcard-match.c	6
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	54
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	27
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
dovecotlib/priorityq.c	12
dovecotlib/istream-data.c	1
dovecotlib/ostream-file.c	5
dovecotlib/ostream.c	34
dovecotlib/iostream-pump.c	10
dovecotlib-smtp/smtp-server.c	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-smtp/./smtp-common.h	1
dovecotlib-smtp/smtp-server-connection.c	54
dovecotlib/connection.c	23
dovecotlib-smtp/smtp-server-command.c	30
dovecotlib-smtp/../..lib/array.h	9
dovecotlib-smtp/smtp-server-cmd-helo.c	7
dovecotlib-smtp/smtp-server-reply.c	24
dovecotlib-smtp/../..lib/str.h	8
dovecotlib-smtp/smtp-command-parser.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	19
dovecotlib-smtp/smtp-server-transaction.c	10
dovecotlib-smtp/smtp-server-recipient.c	17
dovecotlib-smtp/smtp-address.c	16
dovecotlib-smtp/./smtp-address.h	2
dovecotlib-smtp/./smtp-parser.h	7
dovecotlib-smtp/smtp-params.c	27
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	9
dovecotlib/./unichar.h	2
dovecotlib/safe-memset.c	1
dovecotlib/./buffer.h	1
dovecotlib-smtp/./smtp-server-private.h	1
dovecotlib-smtp/smtp-reply-parser.c	1
dovecotlib-smtp/smtp-reply.c	4
dovecotlib-smtp/./smtp-reply.h	1
dovecotlib-smtp/smtp-syntax.c	4
dovecotlib-smtp/smtp-parser.c	12
dovecotlib/strnum.c	18
dovecotlib-smtp/smtp-server-cmd-auth.c	4
dovecotlib-smtp/smtp-server-cmd-starttls.c	5
dovecotlib/iostream-rawlog.c	5
dovecotlib/istream-rawlog.c	2
dovecotlib/ostream-rawlog.c	2
dovecotlib/./time-util.h	3
dovecotlib-smtp/../..lib/ostream.h	1
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-settings/settings.c	51
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/settings-parser.c	30
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/array.h	13
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib/xxh64.c	8
dovecotlib/./xxh64.h	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/strescape.c	2
dovecotlib/str-parse.c	5
dovecotlib-var-expand/expansion-program.c	11
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib/hex-binary.c	2
dovecotlib/read-full.c	1
dovecotlib-settings/./settings-parser.h	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib/primes.c	1
dovecotlib/module-dir.c	23
dovecotlib-smtp/smtp-server-cmd-mail.c	5
dovecotlib-smtp/../..lib/strfuncs.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-smtp/smtp-server-cmd-rcpt.c	8
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-server-cmd-data.c	21
dovecotlib-mail/istream-dot.c	1
dovecotlib/istream-failure-at.c	1
dovecotlib/istream-chain.c	4
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	3
dovecotlib-smtp/smtp-server-cmd-rset.c	3
dovecotlib-smtp/smtp-server-cmd-vrfy.c	2
dovecotlib-smtp/smtp-server-cmd-noop.c	2
dovecotlib-smtp/smtp-server-cmd-quit.c	1
dovecotlib-smtp/smtp-server-cmd-xclient.c	5
dovecotlib-smtp/./smtp-command.h	1
dovecotlib/guid.c	2
dovecotlib/sha1.c	6
dovecotlib-smtp/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	2
dovecotlib/ostream-unix.c	1
dovecotlib/sleep.c	2
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-response-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	609	46.5%
gold	[1:9]	2	0.15%
yellow	[10:29]	16	1.22%
greenyellow	[30:49]	13	0.99%
lawngreen	50+	669	51.1%
All colors	1309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	599	io_stream_free	call site: 00599	lib_signals_ioloop_ref
48	291	i_snprintf	call site: 00291	t_push
44	391	buffer_set_used_size	call site: 00391	event_want_level
40	539	lib_signals_init	call site: 00539	lib_signals_ioloop_switch
38	1183	array_idx_i	call site: 01183	t_strdup_printf
33	1127	iostream_pump_destroy	call site: 01127	io_loop_destroy
32	254	t_malloc_real	call site: 00254	t_strdup_printf
30	220	p_strdup_vprintf	call site: 00220	event_match_field
28	653	buffer_delete	call site: 00653	signal_shadow
23	167	event_want_level	call site: 00167	event_filter_match_source
19	437	str_truncate	call site: 00437	event_get_log_message_str_out
19	1163	i_close_fd_path	call site: 01163	io_remove

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

175

Reachable functions

452

Percentage of reachable functions covered

61.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-response-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	4
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	28
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-response-parser.c	10
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/../..lib/str.h	5
dovecotlib-http/./http-parser.h	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib/strnum.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-suite

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11843	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	11843	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11842	0	EP	call site: 00000	testsuite_message_init

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

2613

Reachable functions

2613

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
pigeonholetestsuite/fuzzsuite.c	2
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	13
dovecotlib/failures.c	41
dovecotlib/randgen.c	7
dovecotlib/hash.c	28
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	2
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	70
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	49
dovecotlib/./array.h	13
dovecotlib/imem.c	8
dovecotlib/buffer.c	28
dovecotlib/mempool.c	2
dovecotlib/event-log.c	17
dovecotlib/event-filter.c	42
dovecotlib/wildcard-match.c	7
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	26
dovecotlib/ioloop.c	68
dovecotlib/ioloop-notify-inotify.c	7
dovecotlib/ioloop-notify-fd.c	3
dovecotlib/istream.c	40
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	10
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
pigeonholelib-sieve-tool/sieve-tool.c	11
dovecotlib/malloc-overflow.h	1
dovecotlib/mempool.h	4
dovecotlib-master/master-service.c	70
dovecotlib/restrict-access.c	17
dovecotlib/process-title.c	8
dovecotlib/env-util.c	3
dovecotlib-master/../..lib/malloc-overflow.h	1
dovecotlib-master/../..lib/mempool.h	3
dovecotlib-settings/settings.c	78
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-master/master-admin-client.c	8
dovecotlib/priorityq.c	12
dovecotlib/./time-util.h	6
dovecotlib/strnum.c	26
dovecotlib/strescape.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	9
dovecotlib/module-dir.c	25
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib/primes.c	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/str-parse.c	5
dovecotlib-master/stats-client.c	16
dovecotlib/connection.c	31
dovecotlib/ostream.c	30
dovecotlib-master/../..lib/str.h	6
dovecotlib-master/../..lib/ostream.h	1
dovecotlib/rand.c	2
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	3
dovecotlib/ostream-unix.c	1
dovecotlib/ostream-file.c	5
dovecotlib-master/../..lib/time-util.h	1
dovecotlib/sleep.c	3
dovecotlib/array.h	10
pigeonholetestsuite/testsuite-common.c	10
dovecotlib/unlink-directory.c	3
dovecotlib/path-util.c	5
dovecotlib-master/master-instance.c	10
dovecotlib-master/../..lib/array.h	10
dovecotlib/file-dotlock.c	24
dovecotlib/file-lock.c	20
dovecotlib/ipwd.c	7
dovecotlib/nfs-workarounds.c	18
dovecotlib/write-full.c	3
dovecotlib/safe-mkstemp.c	8
dovecotlib/hex-binary.c	3
dovecotlib/eacces-error.c	8
dovecotlib-settings/../..lib/array.h	13
dovecotlib-master/master-service-settings.c	14
dovecotlib/sha2.c	4
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-program.c	12
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib/unichar.c	12
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib-master/../..lib/buffer.h	1
dovecotlib/execv-const.c	2
dovecotlib/fdpass.c	1
dovecotlib-master/./storage-version.h	1
dovecotlib/version.c	1
dovecotlib-master/../..lib/strfuncs.h	1
dovecotlib/mmap-util.c	3
dovecotlib/xxh64.c	8
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/settings-parser.c	31
dovecotlib-settings/../..lib/str.h	5
dovecotlib/read-full.c	2
dovecotlib-settings/./settings-parser.h	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-master/master-service-haproxy.c	14
dovecotlib-master/../..lib/lib.h	1
dovecotlib-master/../..lib/byteorder.h	1
dovecotlib/str-sanitize.c	4
dovecotlib-master/master-service-ssl.c	2
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-storage/mail-storage-service.c	43
dovecotlib-storage/mail-storage.c	87
dovecotlib-sasl/dsasl-client.c	4
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	30
dovecotlib-storage/mail-storage-hooks.c	13
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/../..lib/mempool.h	4
dovecotlib-master/syslog-util.c	1
dovecotlib-dict-extra/dict-register.c	2
dovecotlib-dict/dict.c	3
dovecotlib-dict/../..lib/array.h	7
dovecotlib-dict/../..lib/malloc-overflow.h	1
dovecotlib-dict/../..lib/lib.h	1
dovecotlib-storage/../..lib/strfuncs.h	3
dovecotlib-auth-client/auth-master.c	30
dovecotlib-auth-client/../..lib/malloc-overflow.h	1
dovecotlib-auth-client/../..lib/mempool.h	3
dovecotlib/guid.c	3
dovecotlib/sha1.c	6
dovecotlib/safe-memset.c	1
dovecotlib-storage/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-storage/../..lib/str.h	6
dovecotlib-auth-client/auth-master-request.c	16
dovecotlib-auth-client/../..lib/time-util.h	2
dovecotlib-auth-client/../..lib/array.h	7
dovecotlib-auth-client/../..lib/strfuncs.h	2
dovecotlib-auth-client/../..lib/str.h	4
dovecotlib-storage/mail-user.c	17
dovecotlib/hook-build.c	6
dovecotlib/process-stat.c	12
dovecotlib/buffer-istream.c	1
dovecotlib/./istream.h	2
dovecotlib-storage/mail-namespace.c	24
dovecotlib-fs/fs-api.c	14
dovecotlib-fs/../..lib/mempool.h	2
dovecotlib/stats-dist.c	1
dovecotlib-fs/../..lib/array.h	7
dovecotlib-index/mail-index-alloc-cache.c	5
dovecotlib-index/mail-index.c	27
dovecotlib-index/../..lib/module-context.h	2
dovecotlib-index/../..lib/array.h	13
dovecotlib-index/mail-transaction-log.c	21
dovecotlib-index/../..lib/mempool.h	6
dovecotlib-index/mail-transaction-log-file.c	40
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib-index/mail-index-lock.c	2
dovecotlib-index/../..lib/malloc-overflow.h	1
dovecotlib-index/../..lib/lib.h	2
dovecotlib-index/mail-index-modseq.c	13
dovecotlib-index/mail-index-map.c	19
dovecotlib-index/../..lib/buffer.h	1
dovecotlib-index/mail-index-util.c	6
dovecotlib-index/../..lib/byteorder.h	3
dovecotlib-index/mail-index-map-read.c	9
dovecotlib-index/mail-index-sync-update.c	24
dovecotlib-index/mail-index-view.c	15
dovecotlib-index/mail-transaction-log-view.c	14
dovecotlib-index/mail-transaction-log-modseq.c	4
dovecotlib-index/mail-index-sync-ext.c	16
dovecotlib-index/mail-index-sync.c	1
dovecotlib/seq-range-array.c	6
dovecotlib-index/mail-index-sync-keywords.c	7
dovecotlib-index/mail-index-map-hdr.c	6
dovecotlib-index/mail-index-fsck.c	11
dovecotlib-index/mail-index-write.c	4
dovecotlib-index/mail-cache.c	28
dovecotlib/file-cache.c	7
dovecotlib/mmap-anon.c	3
dovecotlib-storage/mailbox-tree.c	10
dovecotlib-index/mailbox-log.c	2
dovecotlib-storage/mail-error.c	2
dovecotlib-fs/../..lib/malloc-overflow.h	1
dovecotlib-fs/../..lib/lib.h	1
pigeonholelib-sieve/sieve.c	18
pigeonholelib-sieve/sieve-error.c	17
pigeonholelib-sieve/sieve-extensions.c	22
pigeonholelib-sieve/sieve-plugins.c	3
pigeonholelib-sieve/sieve-storage.c	13
dovecotlib/lib.h	1
pigeonholetestsuite/testsuite-log.c	7
dovecotlib/str.h	6
pigeonholetestsuite/testsuite-script.c	2
pigeonholetestsuite/testsuite-binary.c	2
pigeonholetestsuite/testsuite-smtp.c	2
dovecotlib/istream-data.c	3
pigeonholelib-sieve/storage/data/sieve-data-script.c	2
pigeonholelib-sieve/sieve-script.c	9
pigeonholelib-sieve/sieve-storage-sync.c	1
pigeonholelib-sieve/sieve-parser.c	8
pigeonholelib-sieve/sieve-lexer.c	12
pigeonholelib-sieve/sieve-ast.c	31
dovecotlib/strfuncs.h	1
pigeonholelib-sieve/./sieve-error-private.h	1
pigeonholelib-sieve/./sieve-lexer.h	5
pigeonholelib-sieve/sieve-validator.c	26
pigeonholelib-sieve/sieve-commands.c	4
pigeonholelib-sieve/sieve-generator.c	6
pigeonholelib-sieve/sieve-binary.c	24
pigeonholelib-sieve/sieve-binary-code.c	11
pigeonholelib-sieve/./sieve-binary-private.h	5
dovecotlib/buffer.h	2
pigeonholelib-sieve/./sieve-binary.h	2
pigeonholelib-sieve/sieve-binary-file.c	6
pigeonholelib-sieve/sieve-binary-debug.c	7
pigeonholelib-sieve/sieve-rusage.c	4
dovecotlib/mkdir-parents.c	6
pigeonholetestsuite/testsuite-mailstore.c	4
pigeonholelib-sieve/util/mail-raw.c	5
dovecotlib-storage/index/raw/raw-storage.c	4
dovecotlib-storage/index/raw/../../../..lib/malloc-overflow.h	1
dovecotlib-storage/index/raw/../../../..lib/mempool.h	1
pigeonholetestsuite/testsuite-message.c	7
dovecotlib-storage/./mail-storage-private.h	1
dovecotlib-storage/../..lib/unicode-data.h	3
dovecotlib-storage/list/mailbox-list-iter.c	20
dovecotlib-storage/list/mailbox-list-subscriptions.c	1
dovecotlib-imap/imap-match.c	4
dovecotlib/bitmap.c	3
dovecotlib-imap/../..lib/bitmap.h	2
dovecotlib-imap/../..lib/bits.h	2
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib-storage/list/../../..lib/array.h	8
dovecotlib-storage/list/../../..lib/malloc-overflow.h	1
dovecotlib-storage/list/../../..lib/mempool.h	4
dovecotlib-storage/list/../../..lib/lib.h	1
dovecotlib-storage/mail-storage-settings.c	4
dovecotlib-storage/list/../../..lib/strfuncs.h	1
dovecotlib/file-create-locked.c	4
dovecotlib-index/mail-index-transaction.c	6
dovecotlib-index/mail-index-transaction-update.c	10
dovecotlib-index/mail-cache-decisions.c	5
dovecotlib-index/mail-cache-purge.c	15
dovecotlib-index/mail-cache-fields.c	14
dovecotlib-index/mail-index-transaction-view.c	1
dovecotlib-index/mail-index-transaction-finish.c	2
dovecotlib-index/mail-cache-lookup.c	9
dovecotlib-index/mail-cache-transaction.c	2
dovecotlib-storage/mailbox-header.c	3
dovecotlib-storage/mail.c	6
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-address.c	7
dovecotlib-smtp/./smtp-parser.h	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/./smtp-address.h	1
dovecotlib-smtp/../..lib/mempool.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-mail/message-id.c	3
dovecotlib-storage/mail-user.h	1
pigeonholetestsuite/testsuite-result.c	3
pigeonholelib-sieve/sieve-execute.c	4
dovecotlib-smtp/../..lib/str.h	5
pigeonholelib-sieve/sieve-result.c	7
pigeonholelib-sieve/sieve-message.c	6
pigeonholelib-sieve/util/edit-mail.c	5
pigeonholelib-sieve/sieve-interpreter.c	12
pigeonholelib-sieve/./sieve-runtime-trace.h	5
pigeonholelib-sieve/sieve-runtime-trace.c	9
dovecotlib/cpu-limit.c	8
pigeonholelib-sieve/sieve-code.c	1
dovecotlib-storage/mail-search-register.c	1
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib/iostream-pump.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
maildir_update_pop3_uidl	/src/dovecot/src/lib-storage/index/maildir/maildir-mail.c	2	['N/A', 'N/A']	62	0	55	8	4	2191	0	12831	3768

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3783 / 11164

Cyclomatic complexity statically reachable by fuzzers

21849 / 59613

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

dovecotlib-imap/fuzz-imap-bodystructure.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

dovecotlib-json/fuzz-json-pointer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'i_close_fd_path', 'i_snprintf', 'buffer_set_used_size', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'event_want_level', 't_memdup_noconst']

dovecotlib-mail/fuzz-message-decoder.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['io_stream_free', 'i_snprintf', 'lib_signals_init', 'array_idx_i', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_set_used_size', 'buffer_delete', 'event_want_level']

dovecotlib-imap/fuzz-imap-utf7.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'buffer_set_used_size', 'i_close_fd_path', 'i_snprintf', 'printf_format_fix_noalloc', 'iostream_pump_destroy', 't_malloc_real', 'buffer_delete', 'event_want_level', 'buffer_check_append_limits']

dovecotlib-mail/fuzz-message-date.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'i_close_fd_path', 'i_snprintf', 'buffer_set_used_size', 'printf_format_fix_noalloc', 'iostream_pump_destroy', 't_malloc_real', 'buffer_check_append_limits', 'buffer_delete', 'event_want_level']

dovecotlib-mail/fuzz-message-parser.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['io_stream_free', 'i_snprintf', 'lib_signals_init', 'buffer_set_used_size', 'array_idx_i', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'event_want_level']

dovecotlib-json/fuzz-istream-json-string.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['i_close_fd_path', 'i_snprintf', 'buffer_set_used_size', 'str_truncate', 'buffer_check_limits', 'p_strdup_vprintf', 'iostream_pump_destroy', 't_malloc_real', 'io_stream_free', 'buffer_check_append_limits']

dovecotlib-var-expand/fuzz-var-expand.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'i_snprintf', 'array_idx_i', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'uni_utf8_parse_char', 'event_want_level', 'buffer_set_used_size']

dovecotlib-var-expand/fuzz-var-expand-import.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'buffer_set_used_size', 'i_close_fd_path', 'i_snprintf', 'printf_format_fix_noalloc', 'iostream_pump_destroy', 't_malloc_real', 'buffer_delete', 'event_want_level', 'buffer_nul_terminate']

dovecotlib-mail/fuzz-qp-decoder.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lib_signals_init', 'i_snprintf', 'i_close_fd_path', 'buffer_copy', 'buffer_check_limits', 'printf_format_fix_noalloc', 'iostream_pump_destroy', 't_malloc_real', 'buffer_check_append_limits', 'buffer_set_used_size']

dovecotlib-json/fuzz-json-istream.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['i_close_fd_path', 'i_snprintf', 'buffer_set_used_size', 'str_truncate', 'buffer_check_limits', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'io_stream_free', 'lib_signals_init']

dovecotlib-http/fuzz-http-request-parser.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['io_stream_free', 'i_snprintf', 'buffer_set_used_size', 'lib_signals_init', 'array_idx_i', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'event_want_level']

dovecotlib-sasl/fuzz-sasl-authentication.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['i_snprintf', 't_malloc_real', 'p_strdup_vprintf', 'io_stream_free', 'lib_signals_ioloop_switched', 'event_want_level', 'buffer_delete', 'priorityq_peek', 'iostream_pump_destroy', 'array_idx_get_space_i']

dovecotlib-smtp/fuzz-smtp-server.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['array_get_modifiable_i', 'i_realloc', 'array_get_i', 'array_delete_i', 'array_create_i', 'array_idx_i', 'array_clear_i', 'str_truncate', 'str_to_uintmax', 'smtp_server_cmd_xclient']

dovecotlib-http/fuzz-http-response-parser.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['io_stream_free', 'i_snprintf', 'buffer_set_used_size', 'lib_signals_init', 'array_idx_i', 'iostream_pump_destroy', 't_malloc_real', 'p_strdup_vprintf', 'buffer_delete', 'event_want_level']

pigeonholetestsuite/fuzzsuite.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag