High level conclusions

Fuzzer fuzz-suite is blocked:

The runtime code coverage of fuzz-suite covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-imap-bodystructure is blocked:

The runtime code coverage of fuzz-imap-bodystructure covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 30.45% of cyclomatic complexity.

Fuzzers reach 28.84% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

3224 / 11177

Cyclomatic complexity statically reachable by fuzzers

18190 / 59719

Runtime code coverage of functions

1652 / 11177

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-qp-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	677	71.4%
gold	[1:9]	2	0.21%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	269	28.3%
All colors	948	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
68	290	i_snprintf	call site: 00290	t_push
58	802	i_close_fd_path	call site: 00802	io_remove
56	421	buffer_copy	call site: 00421	str_vprintfa
43	150	buffer_check_limits	call site: 00150	event_want_level
41	211	printf_format_fix_noalloc	call site: 00211	t_buffer_get
33	764	iostream_pump_destroy	call site: 00764	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
28	361	buffer_check_append_limits	call site: 00361	t_strdup_printf
28	390	buffer_set_used_size	call site: 00390	event_want_level
28	652	buffer_delete	call site: 00652	signal_shadow
22	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

210

Reachable functions

322

Percentage of reachable functions covered

34.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-qp-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib/hex-binary.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-utf7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	601	62.8%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	354	36.9%
All colors	957	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
65	390	buffer_set_used_size	call site: 00390	event_want_level
58	811	i_close_fd_path	call site: 00811	io_remove
48	290	i_snprintf	call site: 00290	t_push
38	211	printf_format_fix_noalloc	call site: 00211	t_buffer_get
33	773	iostream_pump_destroy	call site: 00773	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
28	652	buffer_delete	call site: 00652	signal_shadow
26	166	event_want_level	call site: 00166	event_filter_match_source
16	361	buffer_check_append_limits	call site: 00361	t_strdup_printf
15	462	event_unref	call site: 00462	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

181

Reachable functions

333

Percentage of reachable functions covered

45.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-utf7.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-imap/imap-utf7.c	9
dovecotlib-imap/../..lib/str.h	6
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib/hex-dec.c	1
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-imap/../..lib/unichar.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand-import

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	632	65.1%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	336	34.6%
All colors	970	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
65	390	buffer_set_used_size	call site: 00390	event_want_level
58	824	i_close_fd_path	call site: 00824	io_remove
48	290	i_snprintf	call site: 00290	t_push
38	211	printf_format_fix_noalloc	call site: 00211	t_buffer_get
33	786	iostream_pump_destroy	call site: 00786	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
28	652	buffer_delete	call site: 00652	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf
15	462	event_unref	call site: 00462	event_send
13	763	split_str_fast	call site: 00763	split_str_slow

Runtime coverage analysis

Covered functions

152

Functions that are reachable but not covered

190

Reachable functions

332

Percentage of reachable functions covered

42.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand-import.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	7
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	7
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	2
dovecotlib/strescape.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-response-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	609	46.5%
gold	[1:9]	2	0.15%
yellow	[10:29]	16	1.22%
greenyellow	[30:49]	10	0.76%
lawngreen	50+	671	51.2%
All colors	1308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
48	290	i_snprintf	call site: 00290	t_push
44	390	buffer_set_used_size	call site: 00390	event_want_level
40	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
38	1182	array_idx_i	call site: 01182	t_strdup_printf
33	1126	iostream_pump_destroy	call site: 01126	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
30	219	p_strdup_vprintf	call site: 00219	event_match_field
28	652	buffer_delete	call site: 00652	signal_shadow
23	166	event_want_level	call site: 00166	event_filter_match_source
19	436	str_truncate	call site: 00436	event_get_log_message_str_out
19	1162	i_close_fd_path	call site: 01162	io_remove

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

175

Reachable functions

452

Percentage of reachable functions covered

61.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-response-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	4
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	28
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-response-parser.c	10
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/../..lib/str.h	5
dovecotlib-http/./http-parser.h	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib/strnum.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	746	64.5%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	407	35.2%
All colors	1156	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
48	290	i_snprintf	call site: 00290	t_push
38	1033	array_idx_i	call site: 01033	t_strdup_printf
33	976	iostream_pump_destroy	call site: 00976	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
31	218	p_strdup_vprintf	call site: 00218	event_match_field
28	652	buffer_delete	call site: 00652	signal_shadow
28	802	uni_utf8_parse_char	call site: 00802	append_valid_utf8
23	166	event_want_level	call site: 00166	event_filter_match_source
23	390	buffer_set_used_size	call site: 00390	event_want_level
22	433	t_memdup_noconst	call site: 00433	event_get_log_message_str_out
20	883	array_sort_i	call site: 00883	create_literal

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

193

Reachable functions

397

Percentage of reachable functions covered

51.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	23
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	2
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	3
dovecotlib-var-expand/../..lib/array.h	5
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	3
dovecotlib/strnum.c	11
dovecotlib/unichar.c	5
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-request-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	677	44.1%
gold	[1:9]	12	0.78%
yellow	[10:29]	20	1.30%
greenyellow	[30:49]	3	0.19%
lawngreen	50+	820	53.5%
All colors	1532	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
48	290	i_snprintf	call site: 00290	t_push
44	390	buffer_set_used_size	call site: 00390	event_want_level
40	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
38	1406	array_idx_i	call site: 01406	t_strdup_printf
33	1350	iostream_pump_destroy	call site: 01350	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
30	219	p_strdup_vprintf	call site: 00219	event_match_field
28	652	buffer_delete	call site: 00652	signal_shadow
23	166	event_want_level	call site: 00166	event_filter_match_source
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf
19	436	str_truncate	call site: 00436	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

366

Functions that are reachable but not covered

186

Reachable functions

501

Percentage of reachable functions covered

62.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-request-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-request-parser.c	13
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-url.c	14
dovecotlib/uri-util.c	25
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/./http-parser.h	3
dovecotlib-http/../..lib/str.h	5
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib/strnum.c	5
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/./uri-util.h	1
dovecotlib-http/../..lib/uri-util.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	603	60.1%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	398	39.6%
All colors	1003	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
48	290	i_snprintf	call site: 00290	t_push
40	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
39	390	buffer_set_used_size	call site: 00390	event_want_level
38	877	array_idx_i	call site: 00877	t_strdup_printf
33	820	iostream_pump_destroy	call site: 00820	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
31	218	p_strdup_vprintf	call site: 00218	event_match_field
28	652	buffer_delete	call site: 00652	signal_shadow
23	166	event_want_level	call site: 00166	event_filter_match_source
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf
19	436	str_truncate	call site: 00436	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

272

Functions that are reachable but not covered

171

Reachable functions

347

Percentage of reachable functions covered

50.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	6
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	633	47.2%
gold	[1:9]	2	0.14%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	706	52.6%
All colors	1341	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
48	290	i_snprintf	call site: 00290	t_push
40	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
37	1220	array_idx_i	call site: 01220	t_strdup_printf
33	1163	iostream_pump_destroy	call site: 01163	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
31	218	p_strdup_vprintf	call site: 00218	event_match_field
28	390	buffer_set_used_size	call site: 00390	event_want_level
28	652	buffer_delete	call site: 00652	signal_shadow
23	166	event_want_level	call site: 00166	event_filter_match_source
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf
19	436	str_truncate	call site: 00436	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

337

Functions that are reachable but not covered

176

Reachable functions

444

Percentage of reachable functions covered

60.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	21
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	9
dovecotlib-mail/message-decoder.c	10
dovecotlib-mail/../..lib/base64.h	4
dovecotlib/unichar.c	9
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib/./unichar.h	2
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/rfc822-parser.c	7
dovecotlib-mail/../..lib/str.h	6
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-mail/rfc2231-parser.c	11
dovecotlib/strnum.c	3
dovecotlib-charset/charset-utf8.c	7
dovecotlib-mail/message-address.c	1
dovecotlib-mail/message-header-decode.c	5
dovecotlib-mail/quoted-printable.c	1
dovecotlib/hex-binary.c	1
dovecotlib/base64.c	4
dovecotlib/./base64.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	697	63.7%
gold	[1:9]	2	0.18%
yellow	[10:29]	2	0.18%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	393	35.9%
All colors	1094	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	390	buffer_set_used_size	call site: 00390	event_want_level
68	290	i_snprintf	call site: 00290	t_push
50	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
43	150	buffer_check_limits	call site: 00150	event_want_level
41	211	printf_format_fix_noalloc	call site: 00211	t_buffer_get
41	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
34	972	array_get_modifiable_i	call site: 00972	t_strdup_printf
33	912	iostream_pump_destroy	call site: 00912	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
29	360	buffer_check_append_limits	call site: 00360	t_strdup_printf
28	652	buffer_delete	call site: 00652	signal_shadow
18	950	i_close_fd_path	call site: 00950	io_remove

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

214

Reachable functions

384

Percentage of reachable functions covered

44.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-parser.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	22
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	4
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-imap/imap-parser.c	31
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	8
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-sasl-authentication

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	605	40.0%
gold	[1:9]	13	0.86%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.26%
lawngreen	50+	889	58.8%
All colors	1511	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
48	290	i_snprintf	call site: 00290	t_push
32	253	t_malloc_real	call site: 00253	t_strdup_printf
30	219	p_strdup_vprintf	call site: 00219	event_match_field
29	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
27	539	lib_signals_ioloop_switched	call site: 00539	lib_signals_ioloop_unref
23	166	event_want_level	call site: 00166	event_filter_match_source
22	652	buffer_delete	call site: 00652	signal_shadow
22	1343	priorityq_peek	call site: 01343	t_strdup_printf
20	1403	iostream_pump_destroy	call site: 01403	io_loop_destroy
19	629	array_idx_get_space_i	call site: 00629	signal_read
17	1367	priorityq_deinit	call site: 01367	t_strdup_printf
14	812	i_stream_read_memarea	call site: 00812	i_stream_seek

Runtime coverage analysis

Covered functions

619

Functions that are reachable but not covered

155

Reachable functions

471

Percentage of reachable functions covered

67.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-sasl/fuzz-sasl-authentication.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	12
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	35
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	3
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	21
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib/./lib-event-private.h	1
dovecotlib-auth/password-scheme.c	4
dovecotlib/primes.c	1
dovecotlib-sasl/dsasl-client.c	9
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib/istream-data.c	1
dovecotlib/priorityq.c	8
dovecotlib-sasl/sasl-server.c	4
dovecotlib-sasl/../..lib/mempool.h	2
dovecotlib-sasl/sasl-server-mech-anonymous.c	1
dovecotlib-sasl/sasl-server-mech.c	16
dovecotlib-sasl/sasl-server-mech-cram-md5.c	1
dovecotlib-sasl/sasl-server-mech-digest-md5.c	1
dovecotlib-sasl/sasl-server-mech-login.c	1
dovecotlib-sasl/sasl-server-mech-plain.c	1
dovecotlib-sasl/sasl-server-mech-scram.c	5
dovecotlib-sasl/sasl-server-mech-oauth2.c	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-sasl/sasl-server-request.c	12
dovecotlib-sasl/../..lib/str.h	4
dovecotlib-sasl/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-sasl/../..lib/istream.h	1
dovecotlib-sasl/../..lib/lib.h	1
dovecotlib-sasl/../..lib/buffer.h	1
dovecotlib/safe-memset.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-date

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	614	64.4%
gold	[1:9]	4	0.42%
yellow	[10:29]	6	0.63%
greenyellow	[30:49]	3	0.31%
lawngreen	50+	325	34.1%
All colors	952	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
58	806	i_close_fd_path	call site: 00806	io_remove
48	290	i_snprintf	call site: 00290	t_push
44	390	buffer_set_used_size	call site: 00390	event_want_level
38	211	printf_format_fix_noalloc	call site: 00211	t_buffer_get
33	768	iostream_pump_destroy	call site: 00768	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
28	361	buffer_check_append_limits	call site: 00361	t_strdup_printf
28	652	buffer_delete	call site: 00652	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
19	436	str_truncate	call site: 00436	event_get_log_message_str_out
15	462	event_unref	call site: 00462	event_send

Runtime coverage analysis

Covered functions

158

Functions that are reachable but not covered

185

Reachable functions

330

Percentage of reachable functions covered

43.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-date.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	10
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/message-date.c	4
dovecotlib-mail/rfc822-parser.c	4
dovecotlib-mail/../..lib/str.h	5
dovecotlib/utc-mktime.c	3
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-bodystructure

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1400	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1400	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1399	0	EP	call site: 00000	imap_bodystructure_parse_full

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

432

Reachable functions

432

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-bodystructure.c	6
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	22
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	13
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	5
dovecotlib/memarea.c	2
dovecotlib-imap/imap-bodystructure.c	14
dovecotlib/istream-data.c	1
dovecotlib-imap/imap-parser.c	24
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	7
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	6
dovecotlib/strnum.c	5
dovecotlib-imap/imap-envelope.c	5
dovecotlib-imap/../..lib/str.h	5
dovecotlib-imap/imap-quote.c	7
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-mail/message-part.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-istream-json-string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	673	68.2%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	311	31.5%
All colors	986	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
58	840	i_close_fd_path	call site: 00840	io_remove
57	290	i_snprintf	call site: 00290	t_push
44	390	buffer_set_used_size	call site: 00390	event_want_level
42	435	str_truncate	call site: 00435	event_get_log_message_str_out
39	150	buffer_check_limits	call site: 00150	event_want_level
33	219	p_strdup_vprintf	call site: 00219	event_match_field
33	802	iostream_pump_destroy	call site: 00802	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
29	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
28	361	buffer_check_append_limits	call site: 00361	t_strdup_printf
28	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
28	652	buffer_delete	call site: 00652	signal_shadow

Runtime coverage analysis

Covered functions

232

Functions that are reachable but not covered

198

Reachable functions

345

Percentage of reachable functions covered

42.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-istream-json-string.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib/istream-data.c	1
dovecotlib-json/istream-json-string.c	2
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	1
dovecotlib-json/json-parser.c	2
dovecotlib-json/../..lib/array.h	2
dovecotlib-json/../..lib/istream.h	2
dovecotlib-json/../..lib/str.h	3
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-pointer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	600	61.6%
gold	[1:9]	3	0.30%
yellow	[10:29]	3	0.30%
greenyellow	[30:49]	4	0.41%
lawngreen	50+	363	37.3%
All colors	973	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
58	827	i_close_fd_path	call site: 00827	io_remove
48	290	i_snprintf	call site: 00290	t_push
39	390	buffer_set_used_size	call site: 00390	event_want_level
33	789	iostream_pump_destroy	call site: 00789	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
31	218	p_strdup_vprintf	call site: 00218	event_match_field
28	652	buffer_delete	call site: 00652	signal_shadow
23	166	event_want_level	call site: 00166	event_filter_match_source
22	433	t_memdup_noconst	call site: 00433	event_get_log_message_str_out
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf
15	462	event_unref	call site: 00462	event_send

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

176

Reachable functions

334

Percentage of reachable functions covered

47.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-pointer.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	3
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	6
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-json/json-pointer.c	5
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	2
dovecotlib-json/../..lib/str.h	2
dovecotlib/uri-util.c	7
dovecotlib/./uri-util.h	1
dovecotlib/numpack.c	1
dovecotlib-json/../..lib/lib.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-istream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	750	65.6%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	390	34.1%
All colors	1143	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
58	997	i_close_fd_path	call site: 00997	io_remove
57	290	i_snprintf	call site: 00290	t_push
44	390	buffer_set_used_size	call site: 00390	event_want_level
41	436	str_truncate	call site: 00436	event_get_log_message_str_out
39	150	buffer_check_limits	call site: 00150	event_want_level
33	959	iostream_pump_destroy	call site: 00959	io_loop_destroy
32	253	t_malloc_real	call site: 00253	t_strdup_printf
30	219	p_strdup_vprintf	call site: 00219	event_match_field
29	598	io_stream_free	call site: 00598	lib_signals_ioloop_ref
28	538	lib_signals_init	call site: 00538	lib_signals_ioloop_switch
28	652	buffer_delete	call site: 00652	signal_shadow
19	370	buffer_nul_terminate	call site: 00370	t_strdup_printf

Runtime coverage analysis

Covered functions

254

Functions that are reachable but not covered

213

Reachable functions

390

Percentage of reachable functions covered

45.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-istream.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	11
dovecotlib/event-filter.c	21
dovecotlib/wildcard-match.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-json/json-istream.c	14
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	4
dovecotlib-json/json-parser.c	14
dovecotlib-json/../..lib/array.h	5
dovecotlib-json/./json-types.h	2
dovecotlib-json/json-tree.c	9
dovecotlib-json/../..lib/lib.h	1
dovecotlib-json/../..lib/istream.h	2
dovecotlib/unichar.c	2
dovecotlib/./unichar.h	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-smtp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3167	60.1%
gold	[1:9]	21	0.39%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	2072	39.3%
All colors	5261	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
332	3336	array_get_modifiable_i	call site: 03336	smtp_server_connection_sni_callback
210	2273	i_realloc	call site: 02273	settings_instance_overrides_add_filters
177	3003	array_get_i	call site: 03003	settings_parse_keyidx_value_nodup
153	3182	array_delete_i	call site: 03182	settings_sort_filter_array
143	2658	array_create_i	call site: 02658	var_expand_parser_parse
135	2521	array_clear_i	call site: 02521	settings_instance_override
133	2128	array_idx_i	call site: 02128	settings_instance_override_init
117	4052	str_truncate	call site: 04052	message_address_parse_real
113	1730	str_to_uintmax	call site: 01730	smtp_server_connection_output
96	4608	smtp_server_cmd_xclient	call site: 04608	cmd_xclient_recheck
94	2908	str_truncate	call site: 02908	settings_parse_read_file
77	2001	str_truncate	call site: 02001	settings_get

Runtime coverage analysis

Covered functions

801

Functions that are reachable but not covered

617

Reachable functions

1283

Percentage of reachable functions covered

51.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-smtp/fuzz-smtp-server.c	2
dovecotlib-test/fuzzer.c	4
dovecotlib/lib.c	11
dovecotlib/failures.c	10
dovecotlib/randgen.c	7
dovecotlib/hash.c	20
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	48
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	44
dovecotlib/./array.h	12
dovecotlib/imem.c	5
dovecotlib/buffer.c	24
dovecotlib/mempool.c	2
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	34
dovecotlib/wildcard-match.c	6
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	54
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	27
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
dovecotlib/priorityq.c	12
dovecotlib/istream-data.c	1
dovecotlib/ostream-file.c	5
dovecotlib/ostream.c	34
dovecotlib/iostream-pump.c	10
dovecotlib-smtp/smtp-server.c	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-smtp/./smtp-common.h	1
dovecotlib-smtp/smtp-server-connection.c	54
dovecotlib/connection.c	23
dovecotlib-smtp/smtp-server-command.c	30
dovecotlib-smtp/../..lib/array.h	9
dovecotlib-smtp/smtp-server-cmd-helo.c	7
dovecotlib-smtp/smtp-server-reply.c	24
dovecotlib-smtp/../..lib/str.h	8
dovecotlib-smtp/smtp-command-parser.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	19
dovecotlib-smtp/smtp-server-transaction.c	10
dovecotlib-smtp/smtp-server-recipient.c	17
dovecotlib-smtp/smtp-address.c	16
dovecotlib-smtp/./smtp-address.h	2
dovecotlib-smtp/./smtp-parser.h	7
dovecotlib-smtp/smtp-params.c	27
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	9
dovecotlib/./unichar.h	2
dovecotlib/safe-memset.c	1
dovecotlib/./buffer.h	1
dovecotlib-smtp/./smtp-server-private.h	1
dovecotlib-smtp/smtp-reply-parser.c	1
dovecotlib-smtp/smtp-reply.c	4
dovecotlib-smtp/./smtp-reply.h	1
dovecotlib-smtp/smtp-syntax.c	4
dovecotlib-smtp/smtp-parser.c	12
dovecotlib/strnum.c	18
dovecotlib-smtp/smtp-server-cmd-auth.c	4
dovecotlib-smtp/smtp-server-cmd-starttls.c	5
dovecotlib/iostream-rawlog.c	5
dovecotlib/istream-rawlog.c	2
dovecotlib/ostream-rawlog.c	2
dovecotlib/./time-util.h	3
dovecotlib-smtp/../..lib/ostream.h	1
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-settings/settings.c	51
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/settings-parser.c	30
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/array.h	13
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib/xxh64.c	8
dovecotlib/./xxh64.h	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/strescape.c	2
dovecotlib/str-parse.c	5
dovecotlib-settings/./settings-parser.h	2
dovecotlib-var-expand/expansion-program.c	11
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib/hex-binary.c	2
dovecotlib/read-full.c	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib/primes.c	1
dovecotlib/module-dir.c	23
dovecotlib-smtp/smtp-server-cmd-mail.c	5
dovecotlib-smtp/../..lib/strfuncs.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-smtp/smtp-server-cmd-rcpt.c	8
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-server-cmd-data.c	21
dovecotlib-mail/istream-dot.c	1
dovecotlib/istream-failure-at.c	1
dovecotlib/istream-chain.c	4
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	3
dovecotlib-smtp/smtp-server-cmd-rset.c	3
dovecotlib-smtp/smtp-server-cmd-vrfy.c	2
dovecotlib-smtp/smtp-server-cmd-noop.c	2
dovecotlib-smtp/smtp-server-cmd-quit.c	1
dovecotlib-smtp/smtp-server-cmd-xclient.c	5
dovecotlib-smtp/./smtp-command.h	1
dovecotlib/guid.c	2
dovecotlib/sha1.c	6
dovecotlib-smtp/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	2
dovecotlib/ostream-unix.c	1
dovecotlib/sleep.c	2
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-suite

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11849	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	11849	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11848	0	EP	call site: 00000	testsuite_message_init

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

2614

Reachable functions

2614

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
pigeonholetestsuite/fuzzsuite.c	2
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	13
dovecotlib/failures.c	41
dovecotlib/randgen.c	7
dovecotlib/hash.c	28
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	2
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	70
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	49
dovecotlib/./array.h	13
dovecotlib/imem.c	8
dovecotlib/buffer.c	28
dovecotlib/mempool.c	2
dovecotlib/event-log.c	17
dovecotlib/event-filter.c	42
dovecotlib/wildcard-match.c	7
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	26
dovecotlib/ioloop.c	68
dovecotlib/ioloop-notify-inotify.c	7
dovecotlib/ioloop-notify-fd.c	3
dovecotlib/istream.c	40
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	10
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
pigeonholelib-sieve-tool/sieve-tool.c	11
dovecotlib/malloc-overflow.h	1
dovecotlib/mempool.h	4
dovecotlib-master/master-service.c	70
dovecotlib/restrict-access.c	17
dovecotlib/process-title.c	8
dovecotlib/env-util.c	3
dovecotlib-master/../..lib/malloc-overflow.h	1
dovecotlib-master/../..lib/mempool.h	3
dovecotlib-settings/settings.c	78
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-master/master-admin-client.c	8
dovecotlib/priorityq.c	12
dovecotlib/./time-util.h	6
dovecotlib/strnum.c	26
dovecotlib/strescape.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	9
dovecotlib/module-dir.c	25
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib/primes.c	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/str-parse.c	5
dovecotlib-master/stats-client.c	16
dovecotlib/connection.c	31
dovecotlib/ostream.c	30
dovecotlib-master/../..lib/str.h	6
dovecotlib-master/../..lib/ostream.h	1
dovecotlib/rand.c	2
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	3
dovecotlib/ostream-unix.c	1
dovecotlib/ostream-file.c	5
dovecotlib-master/../..lib/time-util.h	1
dovecotlib/sleep.c	3
dovecotlib/array.h	10
pigeonholetestsuite/testsuite-common.c	10
dovecotlib/unlink-directory.c	3
dovecotlib/path-util.c	5
dovecotlib-master/master-instance.c	10
dovecotlib-master/../..lib/array.h	10
dovecotlib/file-dotlock.c	24
dovecotlib/file-lock.c	20
dovecotlib/ipwd.c	7
dovecotlib/nfs-workarounds.c	18
dovecotlib/write-full.c	3
dovecotlib/safe-mkstemp.c	8
dovecotlib/hex-binary.c	3
dovecotlib/eacces-error.c	8
dovecotlib-settings/../..lib/array.h	13
dovecotlib-master/master-service-settings.c	14
dovecotlib/sha2.c	4
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-program.c	12
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib/unichar.c	12
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib-master/../..lib/buffer.h	1
dovecotlib/execv-const.c	2
dovecotlib/fdpass.c	1
dovecotlib-master/./storage-version.h	1
dovecotlib/version.c	1
dovecotlib-master/../..lib/strfuncs.h	1
dovecotlib/mmap-util.c	3
dovecotlib/xxh64.c	8
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/settings-parser.c	31
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/./settings-parser.h	2
dovecotlib/read-full.c	2
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-master/master-service-haproxy.c	14
dovecotlib-master/../..lib/lib.h	1
dovecotlib-master/../..lib/byteorder.h	1
dovecotlib/str-sanitize.c	4
dovecotlib-master/master-service-ssl.c	2
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-storage/mail-storage-service.c	43
dovecotlib-storage/mail-storage.c	87
dovecotlib-sasl/dsasl-client.c	4
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	30
dovecotlib-storage/mail-storage-hooks.c	13
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/../..lib/mempool.h	4
dovecotlib-master/syslog-util.c	1
dovecotlib-dict-extra/dict-register.c	2
dovecotlib-dict/dict.c	3
dovecotlib-dict/../..lib/array.h	7
dovecotlib-dict/../..lib/malloc-overflow.h	1
dovecotlib-dict/../..lib/lib.h	1
dovecotlib-storage/../..lib/strfuncs.h	3
dovecotlib-auth-client/auth-master.c	30
dovecotlib-auth-client/../..lib/malloc-overflow.h	1
dovecotlib-auth-client/../..lib/mempool.h	3
dovecotlib/guid.c	3
dovecotlib/sha1.c	6
dovecotlib/safe-memset.c	1
dovecotlib-storage/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-storage/../..lib/str.h	6
dovecotlib-auth-client/auth-master-request.c	16
dovecotlib-auth-client/../..lib/time-util.h	2
dovecotlib-auth-client/../..lib/array.h	7
dovecotlib-auth-client/../..lib/strfuncs.h	2
dovecotlib-auth-client/../..lib/str.h	4
dovecotlib-storage/mail-user.c	17
dovecotlib/hook-build.c	6
dovecotlib/process-stat.c	12
dovecotlib/buffer-istream.c	1
dovecotlib/./istream.h	2
dovecotlib-storage/mail-namespace.c	24
dovecotlib-fs/fs-api.c	14
dovecotlib-fs/../..lib/mempool.h	2
dovecotlib/stats-dist.c	1
dovecotlib-fs/../..lib/array.h	7
dovecotlib-index/mail-index-alloc-cache.c	5
dovecotlib-index/mail-index.c	27
dovecotlib-index/../..lib/module-context.h	2
dovecotlib-index/../..lib/array.h	13
dovecotlib-index/mail-transaction-log.c	21
dovecotlib-index/../..lib/mempool.h	6
dovecotlib-index/mail-transaction-log-file.c	40
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib-index/mail-index-lock.c	2
dovecotlib-index/../..lib/malloc-overflow.h	1
dovecotlib-index/../..lib/lib.h	2
dovecotlib-index/mail-index-modseq.c	13
dovecotlib-index/mail-index-map.c	19
dovecotlib-index/../..lib/buffer.h	1
dovecotlib-index/mail-index-util.c	6
dovecotlib-index/../..lib/byteorder.h	3
dovecotlib-index/mail-index-map-read.c	9
dovecotlib-index/mail-index-sync-update.c	24
dovecotlib-index/mail-index-view.c	15
dovecotlib-index/mail-transaction-log-view.c	14
dovecotlib-index/mail-transaction-log-modseq.c	4
dovecotlib-index/mail-index-sync-ext.c	16
dovecotlib-index/mail-index-sync.c	1
dovecotlib/seq-range-array.c	6
dovecotlib-index/mail-index-sync-keywords.c	7
dovecotlib-index/mail-index-map-hdr.c	6
dovecotlib-index/mail-index-fsck.c	11
dovecotlib-index/mail-index-write.c	4
dovecotlib-index/mail-cache.c	28
dovecotlib/file-cache.c	7
dovecotlib/mmap-anon.c	3
dovecotlib-storage/mailbox-tree.c	10
dovecotlib-index/mailbox-log.c	2
dovecotlib-storage/mail-error.c	2
dovecotlib-fs/../..lib/malloc-overflow.h	1
dovecotlib-fs/../..lib/lib.h	1
pigeonholelib-sieve/sieve.c	18
pigeonholelib-sieve/sieve-error.c	17
pigeonholelib-sieve/sieve-extensions.c	22
pigeonholelib-sieve/sieve-plugins.c	3
pigeonholelib-sieve/sieve-storage.c	13
dovecotlib/lib.h	1
pigeonholetestsuite/testsuite-log.c	7
dovecotlib/str.h	6
pigeonholetestsuite/testsuite-script.c	2
pigeonholetestsuite/testsuite-binary.c	2
pigeonholetestsuite/testsuite-smtp.c	2
dovecotlib/istream-data.c	3
pigeonholelib-sieve/storage/data/sieve-data-script.c	2
pigeonholelib-sieve/sieve-script.c	9
pigeonholelib-sieve/sieve-storage-sync.c	1
pigeonholelib-sieve/sieve-parser.c	8
pigeonholelib-sieve/sieve-lexer.c	12
pigeonholelib-sieve/sieve-ast.c	31
dovecotlib/strfuncs.h	1
pigeonholelib-sieve/./sieve-error-private.h	1
pigeonholelib-sieve/./sieve-lexer.h	5
pigeonholelib-sieve/sieve-validator.c	26
pigeonholelib-sieve/sieve-commands.c	4
pigeonholelib-sieve/sieve-generator.c	6
pigeonholelib-sieve/sieve-binary.c	24
pigeonholelib-sieve/sieve-binary-code.c	11
pigeonholelib-sieve/./sieve-binary-private.h	5
dovecotlib/buffer.h	2
pigeonholelib-sieve/./sieve-binary.h	2
pigeonholelib-sieve/sieve-binary-file.c	6
pigeonholelib-sieve/sieve-binary-debug.c	7
pigeonholelib-sieve/sieve-rusage.c	4
dovecotlib/mkdir-parents.c	6
pigeonholetestsuite/testsuite-mailstore.c	4
pigeonholelib-sieve/util/mail-raw.c	5
dovecotlib-storage/index/raw/raw-storage.c	4
dovecotlib-storage/index/raw/../../../..lib/malloc-overflow.h	1
dovecotlib-storage/index/raw/../../../..lib/mempool.h	1
pigeonholetestsuite/testsuite-message.c	7
dovecotlib-storage/./mail-storage-private.h	1
dovecotlib-storage/../..lib/unicode-data.h	3
dovecotlib-storage/list/mailbox-list-iter.c	20
dovecotlib-storage/list/mailbox-list-subscriptions.c	1
dovecotlib-imap/imap-match.c	4
dovecotlib/bitmap.c	3
dovecotlib-imap/../..lib/bitmap.h	2
dovecotlib-imap/../..lib/bits.h	2
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib-storage/list/../../..lib/array.h	8
dovecotlib-storage/list/../../..lib/malloc-overflow.h	1
dovecotlib-storage/list/../../..lib/mempool.h	4
dovecotlib-storage/list/../../..lib/lib.h	1
dovecotlib-storage/mail-storage-settings.c	4
dovecotlib-storage/list/../../..lib/strfuncs.h	1
dovecotlib/file-create-locked.c	4
dovecotlib-index/mail-index-transaction.c	6
dovecotlib-index/mail-index-transaction-update.c	10
dovecotlib-index/mail-cache-decisions.c	5
dovecotlib-index/mail-cache-purge.c	15
dovecotlib-index/mail-cache-fields.c	14
dovecotlib-index/mail-index-transaction-view.c	1
dovecotlib-index/mail-index-transaction-finish.c	2
dovecotlib-index/mail-cache-lookup.c	9
dovecotlib-index/mail-cache-transaction.c	2
dovecotlib-storage/mailbox-header.c	3
dovecotlib-storage/mail.c	6
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-address.c	7
dovecotlib-smtp/./smtp-parser.h	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/./smtp-address.h	1
dovecotlib-smtp/../..lib/mempool.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-mail/message-id.c	3
dovecotlib-storage/mail-user.h	1
pigeonholetestsuite/testsuite-result.c	3
pigeonholelib-sieve/sieve-execute.c	4
dovecotlib-smtp/../..lib/str.h	5
pigeonholelib-sieve/sieve-result.c	7
pigeonholelib-sieve/sieve-message.c	6
pigeonholelib-sieve/util/edit-mail.c	5
pigeonholelib-sieve/sieve-interpreter.c	12
pigeonholelib-sieve/./sieve-runtime-trace.h	5
pigeonholelib-sieve/sieve-runtime-trace.c	9
dovecotlib/cpu-limit.c	8
pigeonholelib-sieve/sieve-code.c	1
dovecotlib-storage/mail-search-register.c	1
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib/iostream-pump.c	3