High level conclusions

Fuzzers reach 31.99% of cyclomatic complexity.

Fuzzers reach 30.25% of all functions.

Fuzzer fuzz-suite is blocked:

The runtime code coverage of fuzz-suite covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-uri-util is blocked:

The runtime code coverage of fuzz-uri-util covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-http-url is blocked:

The runtime code coverage of fuzz-http-url covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-imap-bodystructure is blocked:

The runtime code coverage of fuzz-imap-bodystructure covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3431 / 11342

Cyclomatic complexity statically reachable by fuzzers

19395 / 60614

Runtime code coverage of functions

1953 / 11342

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-imap-utf7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	629	64.5%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	343	35.2%
All colors	974	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
65	395	buffer_set_used_size	call site: 00395	event_want_level
60	166	event_want_level	call site: 00166	event_filter_match_source
58	820	i_close_fd_path	call site: 00820	io_remove
48	295	i_snprintf	call site: 00295	t_push
37	778	iostream_pump_destroy	call site: 00778	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read
10	26	fd_close_on_exec	call site: 00026	random_read

Runtime coverage analysis

Covered functions

162

Functions that are reachable but not covered

193

Reachable functions

342

Percentage of reachable functions covered

43.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-utf7.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-imap/imap-utf7.c	9
dovecotlib-imap/../..lib/str.h	6
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib/hex-dec.c	1
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-imap/../..lib/unichar.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-pointer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	62.1%
gold	[1:9]	2	0.20%
yellow	[10:29]	4	0.40%
greenyellow	[30:49]	2	0.20%
lawngreen	50+	366	37.0%
All colors	989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
58	835	i_close_fd_path	call site: 00835	io_remove
56	166	event_want_level	call site: 00166	event_filter_match_source
48	295	i_snprintf	call site: 00295	t_push
39	395	buffer_set_used_size	call site: 00395	event_want_level
37	793	iostream_pump_destroy	call site: 00793	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
22	438	t_memdup_noconst	call site: 00438	event_get_log_message_str_out
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

172

Functions that are reachable but not covered

184

Reachable functions

343

Percentage of reachable functions covered

46.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-pointer.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	3
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-json/json-pointer.c	5
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	2
dovecotlib-json/../..lib/str.h	2
dovecotlib-url/uri-util.c	7
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/str.h	3
dovecotlib/numpack.c	1
dovecotlib-json/../..lib/lib.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	711	64.0%
gold	[1:9]	2	0.18%
yellow	[10:29]	2	0.18%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	395	35.5%
All colors	1110	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	395	buffer_set_used_size	call site: 00395	event_want_level
76	150	buffer_check_limits	call site: 00150	event_want_level
68	295	i_snprintf	call site: 00295	t_push
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
41	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
37	916	iostream_pump_destroy	call site: 00916	io_loop_destroy
34	980	array_get_modifiable_i	call site: 00980	t_strdup_printf
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	365	buffer_check_append_limits	call site: 00365	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
18	958	i_close_fd_path	call site: 00958	io_remove
13	244	printf_format_fix_noalloc	call site: 00244	t_buffer_get

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

222

Reachable functions

393

Percentage of reachable functions covered

43.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-parser.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	22
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	4
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-imap/imap-parser.c	31
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	8
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-istream-json-string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	687	68.6%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	312	31.1%
All colors	1001	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	150	buffer_check_limits	call site: 00150	event_want_level
58	847	i_close_fd_path	call site: 00847	io_remove
57	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
41	440	str_truncate	call site: 00440	event_get_log_message_str_out
37	805	iostream_pump_destroy	call site: 00805	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
28	656	buffer_delete	call site: 00656	signal_shadow
22	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

206

Reachable functions

354

Percentage of reachable functions covered

41.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-istream-json-string.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib/istream-data.c	1
dovecotlib-json/istream-json-string.c	2
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	1
dovecotlib-json/json-parser.c	2
dovecotlib-json/../..lib/array.h	2
dovecotlib-json/../..lib/istream.h	2
dovecotlib-json/../..lib/str.h	3
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-istream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	762	65.8%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	392	33.8%
All colors	1157	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	150	buffer_check_limits	call site: 00150	event_want_level
58	1003	i_close_fd_path	call site: 01003	io_remove
57	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
40	441	str_truncate	call site: 00441	event_get_log_message_str_out
37	961	iostream_pump_destroy	call site: 00961	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
28	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
28	656	buffer_delete	call site: 00656	signal_shadow
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	633	array_idx_get_space_i	call site: 00633	signal_read

Runtime coverage analysis

Covered functions

255

Functions that are reachable but not covered

221

Reachable functions

399

Percentage of reachable functions covered

44.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-istream.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-json/json-istream.c	14
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	4
dovecotlib-json/json-parser.c	14
dovecotlib-json/../..lib/array.h	5
dovecotlib-json/./json-types.h	2
dovecotlib-json/json-tree.c	9
dovecotlib-json/../..lib/lib.h	1
dovecotlib-json/../..lib/istream.h	2
dovecotlib/unichar.c	2
dovecotlib/./unichar.h	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-response-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	619	46.8%
gold	[1:9]	2	0.15%
yellow	[10:29]	22	1.66%
greenyellow	[30:49]	7	0.53%
lawngreen	50+	670	50.7%
All colors	1320	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
38	1186	array_idx_i	call site: 01186	t_strdup_printf
37	1126	iostream_pump_destroy	call site: 01126	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
18	1167	i_close_fd_path	call site: 01167	io_remove

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

180

Reachable functions

458

Percentage of reachable functions covered

60.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-response-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	4
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	8
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	28
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-response-parser.c	10
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/../..lib/str.h	5
dovecotlib-http/./http-parser.h	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	645	47.6%
gold	[1:9]	2	0.14%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	707	52.2%
All colors	1354	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
37	1163	iostream_pump_destroy	call site: 01163	io_loop_destroy
37	1224	array_idx_i	call site: 01224	t_strdup_printf
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	395	buffer_set_used_size	call site: 00395	event_want_level
28	656	buffer_delete	call site: 00656	signal_shadow
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

341

Functions that are reachable but not covered

182

Reachable functions

451

Percentage of reachable functions covered

59.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	21
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	9
dovecotlib-mail/message-decoder.c	10
dovecotlib-mail/../..lib/base64.h	4
dovecotlib/unichar.c	9
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib/./unichar.h	2
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/rfc822-parser.c	7
dovecotlib-mail/../..lib/str.h	6
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-mail/rfc2231-parser.c	11
dovecotlib-charset/charset-utf8.c	7
dovecotlib-mail/message-address.c	1
dovecotlib-mail/message-header-decode.c	5
dovecotlib-mail/quoted-printable.c	1
dovecotlib/hex-binary.c	1
dovecotlib/base64.c	4
dovecotlib/./base64.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-request-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	685	44.2%
gold	[1:9]	6	0.38%
yellow	[10:29]	24	1.55%
greenyellow	[30:49]	5	0.32%
lawngreen	50+	828	53.4%
All colors	1548	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
38	1414	array_idx_i	call site: 01414	t_strdup_printf
37	1354	iostream_pump_destroy	call site: 01354	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

367

Functions that are reachable but not covered

191

Reachable functions

507

Percentage of reachable functions covered

62.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-request-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	6
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-request-parser.c	13
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-url/http-url.c	13
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/./http-parser.h	3
dovecotlib-http/../..lib/str.h	4
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib-http/http-request.c	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-http/../..lib-url/uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-date

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	628	64.8%
gold	[1:9]	4	0.41%
yellow	[10:29]	6	0.61%
greenyellow	[30:49]	3	0.30%
lawngreen	50+	327	33.7%
All colors	968	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
60	166	event_want_level	call site: 00166	event_filter_match_source
58	814	i_close_fd_path	call site: 00814	io_remove
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
37	772	iostream_pump_destroy	call site: 00772	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

159

Functions that are reachable but not covered

193

Reachable functions

339

Percentage of reachable functions covered

43.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-date.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	10
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/message-date.c	4
dovecotlib-mail/rfc822-parser.c	4
dovecotlib-mail/../..lib/str.h	5
dovecotlib/utc-mktime.c	3
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-bodystructure

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1411	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1411	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1410	0	EP	call site: 00000	imap_bodystructure_parse_full

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

437

Reachable functions

437

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-bodystructure.c	6
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	22
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	13
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	5
dovecotlib/memarea.c	2
dovecotlib-imap/imap-bodystructure.c	14
dovecotlib/istream-data.c	1
dovecotlib-imap/imap-parser.c	24
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	7
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	6
dovecotlib-imap/imap-envelope.c	5
dovecotlib-imap/../..lib/str.h	5
dovecotlib-imap/imap-quote.c	7
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-mail/message-part.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand-import

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	646	65.5%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	338	34.2%
All colors	986	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
65	395	buffer_set_used_size	call site: 00395	event_want_level
60	166	event_want_level	call site: 00166	event_filter_match_source
58	832	i_close_fd_path	call site: 00832	io_remove
48	295	i_snprintf	call site: 00295	t_push
37	790	iostream_pump_destroy	call site: 00790	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
14	467	event_unref	call site: 00467	event_send
13	767	split_str_fast	call site: 00767	split_str_slow
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

198

Reachable functions

341

Percentage of reachable functions covered

41.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand-import.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	7
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	7
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	2
dovecotlib/strescape.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1137	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1136	0	EP	call site: 00000	http_url_parse

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

380

Reachable functions

380

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-url/fuzz-http-url.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	60.3%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	402	39.4%
All colors	1019	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
39	395	buffer_set_used_size	call site: 00395	event_want_level
38	885	array_idx_i	call site: 00885	t_strdup_printf
37	824	iostream_pump_destroy	call site: 00824	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	656	buffer_delete	call site: 00656	signal_shadow
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

273

Functions that are reachable but not covered

177

Reachable functions

356

Percentage of reachable functions covered

50.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	6
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-qp-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	691	71.6%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	271	28.1%
All colors	964	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
76	150	buffer_check_limits	call site: 00150	event_want_level
68	295	i_snprintf	call site: 00295	t_push
58	810	i_close_fd_path	call site: 00810	io_remove
55	426	buffer_copy	call site: 00426	str_vprintfa
37	768	iostream_pump_destroy	call site: 00768	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	395	buffer_set_used_size	call site: 00395	event_want_level
28	656	buffer_delete	call site: 00656	signal_shadow
22	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event
13	244	printf_format_fix_noalloc	call site: 00244	t_buffer_get

Runtime coverage analysis

Covered functions

117

Functions that are reachable but not covered

218

Reachable functions

331

Percentage of reachable functions covered

34.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-qp-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib/hex-binary.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-uri-util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1062	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1062	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1061	0	EP	call site: 00000	uri_check

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

366

Reachable functions

366

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-url/fuzz-uri-util.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-url/uri-util.c	24
dovecotlib-url/../..lib/str.h	4
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-sasl-authentication

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	613	40.1%
gold	[1:9]	13	0.85%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.26%
lawngreen	50+	895	58.6%
All colors	1525	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
48	295	i_snprintf	call site: 00295	t_push
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
27	166	event_want_level	call site: 00166	event_filter_match_source
27	543	lib_signals_ioloop_switched	call site: 00543	lib_signals_ioloop_unref
26	196	str_parse_uintmax	call site: 00196	event_match_field
22	656	buffer_delete	call site: 00656	signal_shadow
22	1349	priorityq_peek	call site: 01349	t_strdup_printf
20	1409	iostream_pump_destroy	call site: 01409	io_loop_destroy
19	633	array_idx_get_space_i	call site: 00633	signal_read
17	1373	priorityq_deinit	call site: 01373	t_strdup_printf
14	820	i_stream_read_memarea	call site: 00820	i_stream_seek

Runtime coverage analysis

Covered functions

620

Functions that are reachable but not covered

159

Reachable functions

480

Percentage of reachable functions covered

66.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-sasl/fuzz-sasl-authentication.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	12
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	35
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	3
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	21
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib/./lib-event-private.h	1
dovecotlib-auth/password-scheme.c	4
dovecotlib/primes.c	1
dovecotlib-sasl/dsasl-client.c	9
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib/istream-data.c	1
dovecotlib/priorityq.c	8
dovecotlib-sasl/sasl-server.c	4
dovecotlib-sasl/../..lib/mempool.h	2
dovecotlib-sasl/sasl-server-mech-anonymous.c	1
dovecotlib-sasl/sasl-server-mech.c	16
dovecotlib-sasl/sasl-server-mech-cram-md5.c	1
dovecotlib-sasl/sasl-server-mech-digest-md5.c	1
dovecotlib-sasl/sasl-server-mech-login.c	1
dovecotlib-sasl/sasl-server-mech-plain.c	1
dovecotlib-sasl/sasl-server-mech-scram.c	5
dovecotlib-sasl/sasl-server-mech-oauth2.c	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-sasl/sasl-server-request.c	12
dovecotlib-sasl/../..lib/str.h	4
dovecotlib-sasl/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-sasl/../..lib/istream.h	1
dovecotlib-sasl/../..lib/lib.h	1
dovecotlib-sasl/../..lib/buffer.h	1
dovecotlib/safe-memset.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-smtp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3471	62.3%
gold	[1:9]	20	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	2077	37.2%
All colors	5569	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
332	3645	array_get_modifiable_i	call site: 03645	smtp_server_connection_sni_callback
270	3024	str_truncate	call site: 03024	settings_parse_keyidx_value_nodup
202	2310	i_realloc	call site: 02310	settings_default_overrides_update
182	3462	array_get_i	call site: 03462	settings_sort_filter_array
145	2023	array_create_i	call site: 02023	settings_instance_get
142	2775	array_create_i	call site: 02775	var_expand_parser_parse
128	2645	array_clear_i	call site: 02645	settings_instance_override
117	1727	t_strdup_until_noconst	call site: 01727	smtp_server_connection_output
117	4361	str_truncate	call site: 04361	message_address_parse_real
96	4910	smtp_server_cmd_xclient	call site: 04910	cmd_xclient_recheck
82	2216	array_idx_i	call site: 02216	settings_instance_override_init
82	3360	str_truncate	call site: 03360	http_url_parse_authority_form

Runtime coverage analysis

Covered functions

802

Functions that are reachable but not covered

690

Reachable functions

1357

Percentage of reachable functions covered

49.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-smtp/fuzz-smtp-server.c	2
dovecotlib-test/fuzzer.c	4
dovecotlib/lib.c	11
dovecotlib/failures.c	10
dovecotlib/randgen.c	7
dovecotlib/hash.c	21
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	48
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	44
dovecotlib/./array.h	12
dovecotlib/imem.c	5
dovecotlib/buffer.c	24
dovecotlib/mempool.c	2
dovecotlib/event-log.c	14
dovecotlib/event-filter.c	37
dovecotlib/wildcard-match.c	6
dovecotlib/strnum.c	18
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	54
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	27
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
dovecotlib/priorityq.c	12
dovecotlib/istream-data.c	1
dovecotlib/ostream-file.c	5
dovecotlib/ostream.c	34
dovecotlib/iostream-pump.c	10
dovecotlib-smtp/smtp-server.c	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-smtp/./smtp-common.h	1
dovecotlib-smtp/smtp-server-connection.c	54
dovecotlib/connection.c	23
dovecotlib-smtp/smtp-server-command.c	30
dovecotlib-smtp/../..lib/array.h	9
dovecotlib-smtp/smtp-server-cmd-helo.c	7
dovecotlib-smtp/smtp-server-reply.c	24
dovecotlib-smtp/../..lib/str.h	8
dovecotlib-smtp/smtp-command-parser.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	20
dovecotlib-smtp/smtp-server-transaction.c	10
dovecotlib-smtp/smtp-server-recipient.c	17
dovecotlib-smtp/smtp-address.c	16
dovecotlib-smtp/./smtp-address.h	2
dovecotlib-smtp/./smtp-parser.h	7
dovecotlib-smtp/smtp-params.c	27
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	9
dovecotlib/./unichar.h	2
dovecotlib/safe-memset.c	1
dovecotlib/./buffer.h	1
dovecotlib-smtp/./smtp-server-private.h	1
dovecotlib-smtp/smtp-reply-parser.c	1
dovecotlib-smtp/smtp-reply.c	4
dovecotlib-smtp/./smtp-reply.h	1
dovecotlib-smtp/smtp-syntax.c	4
dovecotlib-smtp/smtp-parser.c	12
dovecotlib-smtp/smtp-server-cmd-auth.c	4
dovecotlib-smtp/smtp-server-cmd-starttls.c	5
dovecotlib/iostream-rawlog.c	5
dovecotlib/istream-rawlog.c	2
dovecotlib/ostream-rawlog.c	2
dovecotlib/./time-util.h	3
dovecotlib-smtp/../..lib/ostream.h	1
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-settings/settings.c	58
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/../..lib/array.h	13
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/settings-parser.c	31
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/strescape.c	2
dovecotlib/str-parse.c	6
dovecotlib-settings/settings-bin-filter.c	11
dovecotlib-settings/./settings-bin-filter.h	3
dovecotlib-settings/../..lib/bits.h	1
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/./settings-parser.h	2
dovecotlib-var-expand/expansion-program.c	11
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib/hex-binary.c	2
dovecotlib/read-full.c	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib/primes.c	1
dovecotlib/module-dir.c	23
dovecotlib-smtp/smtp-server-cmd-mail.c	5
dovecotlib-smtp/../..lib/strfuncs.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-smtp/smtp-server-cmd-rcpt.c	8
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-server-cmd-data.c	21
dovecotlib-mail/istream-dot.c	1
dovecotlib/istream-failure-at.c	1
dovecotlib/istream-chain.c	4
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	3
dovecotlib-smtp/smtp-server-cmd-rset.c	3
dovecotlib-smtp/smtp-server-cmd-vrfy.c	2
dovecotlib-smtp/smtp-server-cmd-noop.c	2
dovecotlib-smtp/smtp-server-cmd-quit.c	1
dovecotlib-smtp/smtp-server-cmd-xclient.c	5
dovecotlib-smtp/./smtp-command.h	1
dovecotlib/guid.c	2
dovecotlib/sha1.c	6
dovecotlib-smtp/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	2
dovecotlib/ostream-unix.c	1
dovecotlib/sleep.c	2
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	758	64.7%
gold	[1:9]	2	0.17%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	409	34.9%
All colors	1170	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
48	295	i_snprintf	call site: 00295	t_push
38	1039	array_idx_i	call site: 01039	t_strdup_printf
37	978	iostream_pump_destroy	call site: 00978	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	656	buffer_delete	call site: 00656	signal_shadow
28	806	uni_utf8_parse_char	call site: 00806	append_valid_utf8
26	196	str_parse_uintmax	call site: 00196	event_match_field
23	395	buffer_set_used_size	call site: 00395	event_want_level
22	438	t_memdup_noconst	call site: 00438	event_get_log_message_str_out
20	887	array_sort_i	call site: 00887	create_literal

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

199

Reachable functions

404

Percentage of reachable functions covered

50.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	23
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	13
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	2
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	3
dovecotlib-var-expand/../..lib/array.h	5
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	3
dovecotlib/unichar.c	5
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-mail-search-args-simplify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1089	49.7%
gold	[1:9]	6	0.27%
yellow	[10:29]	5	0.22%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1090	49.7%
All colors	2190	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
208	1771	mail_transaction_log_close	call site: 01771	mail_transaction_log_file_free
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
102	1646	mail_search_arg_to_imap	call site: 01646	mail_search_mime_part_to_imap
48	295	i_snprintf	call site: 00295	t_push
36	2064	array_idx_i	call site: 02064	t_strdup_printf
35	2005	fuzzer_deinit	call site: 02005	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
32	1407	mailbox_keywords_create_skip	call site: 01407	imap_match_init
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
25	395	buffer_set_used_size	call site: 00395	event_want_level

Runtime coverage analysis

Covered functions

544

Functions that are reachable but not covered

261

Reachable functions

638

Percentage of reachable functions covered

59.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-storage/fuzz-mail-search-args-simplify.c	14
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	10
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	15
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	21
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	32
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	27
dovecotlib/./array.h	14
dovecotlib/imem.c	4
dovecotlib/buffer.c	22
dovecotlib/mempool.c	1
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	6
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-storage/mail-storage.c	5
dovecotlib-sasl/dsasl-client.c	4
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	6
dovecotlib-storage/mail-storage-hooks.c	3
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-settings/settings.c	3
dovecotlib-settings/../..lib/array.h	5
dovecotlib-settings/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/mail-search-parser-cmdline.c	1
dovecotlib-storage/../..lib/mempool.h	3
dovecotlib-storage/mail-search-register-imap.c	4
dovecotlib-storage/mail-search-register.c	7
dovecotlib-storage/mail-search-build.c	8
dovecotlib-imap/imap-seqset.c	3
dovecotlib/seq-range-array.c	12
dovecotlib/restrict-process-size.c	1
dovecotlib-storage/mail-search-parser.c	3
dovecotlib-charset/charset-utf8.c	4
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib-storage/mail-search.c	12
dovecotlib-storage/mailbox-keywords.c	5
dovecotlib-index/mail-index.c	14
dovecotlib-index/../..lib/mempool.h	3
dovecotlib-imap/imap-match.c	7
dovecotlib-imap/../..lib/mempool.h	2
dovecotlib-storage/mailbox-search-result.c	1
dovecotlib-index/../..lib/malloc-overflow.h	2
dovecotlib/./lib-event-private.h	1
dovecotlib-index/../..lib/array.h	8
dovecotlib/primes.c	1
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-index/mail-transaction-log.c	4
dovecotlib-index/mail-index-modseq.c	1
dovecotlib-storage/mailbox-get.c	1
dovecotlib-index/mail-index-view.c	1
dovecotlib/./seq-range-array.h	1
dovecotlib-storage/mail-search-args-simplify.c	24
dovecotlib-storage/mail-search-mime.c	7
dovecotlib-storage/mail-namespace.c	1
dovecotlib-imap/../..lib/malloc-overflow.h	2
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/unichar.c	5
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib/crc32.c	2
dovecotlib-storage/../..lib/crc32.h	1
dovecotlib-storage/mail-search-args-imap.c	5
dovecotlib-storage/../..lib/str.h	4
dovecotlib-imap/imap-util.c	2
dovecotlib-imap/../..lib/array.h	2
dovecotlib-imap/../..lib/str.h	5
dovecotlib-storage/../..lib/bits.h	1
dovecotlib-imap/imap-arg.c	1
dovecotlib/utc-offset.c	1
dovecotlib-imap/imap-date.c	2
dovecotlib-imap/imap-quote.c	5
dovecotlib-storage/mail-thread.c	1
dovecotlib-index/mail-transaction-log-file.c	2
dovecotlib/nfs-workarounds.c	7
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib/eacces-error.c	7
dovecotlib/path-util.c	2
dovecotlib/ipwd.c	5
dovecotlib/restrict-access.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-suite

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12328	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	12328	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12327	0	EP	call site: 00000	testsuite_message_init

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

2724

Reachable functions

2724

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
pigeonholetestsuite/fuzzsuite.c	2
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	13
dovecotlib/failures.c	41
dovecotlib/randgen.c	7
dovecotlib/hash.c	28
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	2
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	70
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	49
dovecotlib/./array.h	13
dovecotlib/imem.c	8
dovecotlib/buffer.c	28
dovecotlib/mempool.c	2
dovecotlib/event-log.c	18
dovecotlib/event-filter.c	40
dovecotlib/wildcard-match.c	7
dovecotlib/strnum.c	28
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	27
dovecotlib/ioloop.c	68
dovecotlib/ioloop-notify-inotify.c	7
dovecotlib/ioloop-notify-fd.c	3
dovecotlib/istream.c	40
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	10
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
pigeonholelib-sieve-tool/sieve-tool.c	11
dovecotlib/malloc-overflow.h	1
dovecotlib/mempool.h	4
dovecotlib-master/master-service.c	77
dovecotlib/restrict-access.c	17
dovecotlib/process-title.c	8
dovecotlib/env-util.c	3
dovecotlib-master/../..lib/malloc-overflow.h	1
dovecotlib-master/../..lib/mempool.h	3
dovecotlib-settings/settings.c	82
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-master/master-admin-client.c	8
dovecotlib/priorityq.c	12
dovecotlib/./time-util.h	6
dovecotlib/strescape.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	11
dovecotlib/module-dir.c	25
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib/primes.c	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/str-parse.c	6
dovecotlib-master/stats-client.c	17
dovecotlib/connection.c	31
dovecotlib/ostream.c	30
dovecotlib-master/../..lib/str.h	6
dovecotlib-master/../..lib/ostream.h	1
dovecotlib/rand.c	2
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	3
dovecotlib/ostream-unix.c	1
dovecotlib/ostream-file.c	5
dovecotlib-master/../..lib/time-util.h	1
dovecotlib/sleep.c	3
dovecotlib/array.h	10
pigeonholetestsuite/testsuite-common.c	10
dovecotlib/unlink-directory.c	3
dovecotlib/path-util.c	5
dovecotlib-master/master-instance.c	10
dovecotlib-master/../..lib/array.h	10
dovecotlib/file-dotlock.c	24
dovecotlib/file-lock.c	20
dovecotlib/ipwd.c	7
dovecotlib/nfs-workarounds.c	18
dovecotlib/write-full.c	3
dovecotlib/safe-mkstemp.c	8
dovecotlib/hex-binary.c	3
dovecotlib/eacces-error.c	8
dovecotlib-settings/../..lib/array.h	13
dovecotlib-master/master-service-settings.c	14
dovecotlib/sha2.c	4
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-program.c	12
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib/unichar.c	12
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib-master/../..lib/buffer.h	1
dovecotlib/execv-const.c	2
dovecotlib/fdpass.c	1
dovecotlib-master/./storage-version.h	1
dovecotlib/version.c	1
dovecotlib-master/../..lib/strfuncs.h	1
dovecotlib/mmap-util.c	3
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/settings-bin-filter.c	21
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib-settings/../..lib/bits.h	2
dovecotlib-settings/settings-parser.c	32
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/./settings-bin-filter.h	3
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/./settings-parser.h	2
dovecotlib/read-full.c	2
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-master/master-service-haproxy.c	14
dovecotlib-master/../..lib/lib.h	1
dovecotlib-master/../..lib/byteorder.h	1
dovecotlib/str-sanitize.c	4
dovecotlib-master/master-service-ssl.c	2
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-storage/mail-storage-service.c	43
dovecotlib-storage/mail-storage.c	87
dovecotlib-sasl/dsasl-client.c	4
dovecotlib-sasl/../..lib/array.h	5
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	30
dovecotlib-storage/mail-storage-hooks.c	13
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/../..lib/mempool.h	4
dovecotlib-master/syslog-util.c	1
dovecotlib-dict-extra/dict-register.c	2
dovecotlib-dict/dict.c	3
dovecotlib-dict/../..lib/array.h	7
dovecotlib-dict/../..lib/malloc-overflow.h	1
dovecotlib-dict/../..lib/lib.h	1
dovecotlib-storage/../..lib/strfuncs.h	3
dovecotlib-auth-client/auth-master.c	30
dovecotlib-auth-client/../..lib/malloc-overflow.h	1
dovecotlib-auth-client/../..lib/mempool.h	3
dovecotlib/guid.c	3
dovecotlib/sha1.c	6
dovecotlib/safe-memset.c	1
dovecotlib-storage/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-storage/../..lib/str.h	6
dovecotlib-auth-client/auth-master-request.c	16
dovecotlib-auth-client/../..lib/time-util.h	2
dovecotlib-auth-client/../..lib/array.h	7
dovecotlib-auth-client/../..lib/strfuncs.h	2
dovecotlib-auth-client/../..lib/str.h	4
dovecotlib-storage/mail-user.c	17
dovecotlib/hook-build.c	6
dovecotlib/process-stat.c	12
dovecotlib/buffer-istream.c	1
dovecotlib/./istream.h	2
dovecotlib-storage/mail-namespace.c	24
dovecotlib-fs/fs-api.c	14
dovecotlib-fs/../..lib/mempool.h	2
dovecotlib/stats-dist.c	1
dovecotlib-fs/../..lib/array.h	7
dovecotlib-index/mail-index-alloc-cache.c	5
dovecotlib-index/mail-index.c	27
dovecotlib-index/../..lib/module-context.h	2
dovecotlib-index/../..lib/array.h	13
dovecotlib-index/mail-transaction-log.c	21
dovecotlib-index/../..lib/mempool.h	6
dovecotlib-index/mail-transaction-log-file.c	40
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib-index/mail-index-lock.c	2
dovecotlib/file-lock-proc.c	25
dovecotlib-index/../..lib/malloc-overflow.h	1
dovecotlib-index/../..lib/lib.h	2
dovecotlib-index/mail-index-modseq.c	13
dovecotlib-index/mail-index-map.c	19
dovecotlib-index/../..lib/buffer.h	1
dovecotlib-index/mail-index-util.c	6
dovecotlib-index/../..lib/byteorder.h	3
dovecotlib-index/mail-index-map-read.c	9
dovecotlib-index/mail-index-sync-update.c	24
dovecotlib-index/mail-index-view.c	15
dovecotlib-index/mail-transaction-log-view.c	14
dovecotlib-index/mail-transaction-log-modseq.c	4
dovecotlib-index/mail-index-sync-ext.c	16
dovecotlib-index/mail-index-sync.c	1
dovecotlib/seq-range-array.c	6
dovecotlib-index/mail-index-sync-keywords.c	7
dovecotlib-index/mail-index-map-hdr.c	6
dovecotlib-index/mail-index-fsck.c	11
dovecotlib-index/mail-index-write.c	4
dovecotlib-index/mail-cache.c	28
dovecotlib/file-cache.c	7
dovecotlib/mmap-anon.c	3
dovecotlib-storage/mailbox-tree.c	10
dovecotlib-index/mailbox-log.c	2
dovecotlib-storage/mail-error.c	2
dovecotlib-fs/../..lib/malloc-overflow.h	1
dovecotlib-fs/../..lib/lib.h	1
pigeonholelib-sieve/sieve.c	18
pigeonholelib-sieve/sieve-error.c	17
pigeonholelib-sieve/sieve-extensions.c	22
pigeonholelib-sieve/sieve-plugins.c	3
pigeonholelib-sieve/sieve-storage.c	13
dovecotlib/lib.h	1
pigeonholetestsuite/testsuite-log.c	7
dovecotlib/str.h	6
pigeonholetestsuite/testsuite-script.c	2
pigeonholetestsuite/testsuite-binary.c	2
pigeonholetestsuite/testsuite-smtp.c	2
dovecotlib/istream-data.c	3
pigeonholelib-sieve/storage/data/sieve-data-script.c	2
pigeonholelib-sieve/sieve-script.c	9
pigeonholelib-sieve/sieve-storage-sync.c	1
pigeonholelib-sieve/sieve-parser.c	8
pigeonholelib-sieve/sieve-lexer.c	12
pigeonholelib-sieve/sieve-ast.c	31
dovecotlib/strfuncs.h	1
pigeonholelib-sieve/./sieve-error-private.h	1
pigeonholelib-sieve/./sieve-lexer.h	5
pigeonholelib-sieve/sieve-validator.c	26
pigeonholelib-sieve/sieve-commands.c	4
pigeonholelib-sieve/sieve-generator.c	6
pigeonholelib-sieve/sieve-binary.c	24
pigeonholelib-sieve/sieve-binary-code.c	11
pigeonholelib-sieve/./sieve-binary-private.h	5
dovecotlib/buffer.h	2
pigeonholelib-sieve/./sieve-binary.h	2
pigeonholelib-sieve/sieve-binary-file.c	6
pigeonholelib-sieve/sieve-binary-debug.c	7
pigeonholelib-sieve/sieve-rusage.c	4
dovecotlib/mkdir-parents.c	6
pigeonholetestsuite/testsuite-mailstore.c	4
pigeonholelib-sieve/util/mail-raw.c	5
dovecotlib-storage/index/raw/raw-storage.c	4
dovecotlib-storage/index/raw/../../../..lib/malloc-overflow.h	1
dovecotlib-storage/index/raw/../../../..lib/mempool.h	1
pigeonholetestsuite/testsuite-message.c	7
dovecotlib/rate-limit.c	1
dovecotlib-storage/./mail-storage-private.h	1
dovecotlib-storage/../..lib/unicode-data.h	3
dovecotlib-storage/list/mailbox-list-iter.c	20
dovecotlib-storage/list/mailbox-list-subscriptions.c	1
dovecotlib-imap/imap-match.c	4
dovecotlib/bitmap.c	3
dovecotlib-imap/../..lib/bitmap.h	2
dovecotlib-imap/../..lib/bits.h	2
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib-storage/list/../../..lib/array.h	8
dovecotlib-storage/list/../../..lib/malloc-overflow.h	1
dovecotlib-storage/list/../../..lib/mempool.h	4
dovecotlib-storage/list/../../..lib/lib.h	1
dovecotlib-storage/mail-storage-settings.c	4
dovecotlib-storage/list/../../..lib/strfuncs.h	1
dovecotlib/file-create-locked.c	4
dovecotlib-index/mail-index-transaction.c	6
dovecotlib-index/mail-index-transaction-update.c	10
dovecotlib-index/mail-cache-decisions.c	5
dovecotlib-index/mail-cache-purge.c	15
dovecotlib-index/mail-cache-fields.c	14
dovecotlib-index/mail-index-transaction-view.c	1
dovecotlib-index/mail-index-transaction-finish.c	2
dovecotlib-index/mail-cache-lookup.c	9
dovecotlib-index/mail-cache-transaction.c	2
dovecotlib-storage/mailbox-header.c	3
dovecotlib-storage/mail.c	6
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-address.c	7
dovecotlib-smtp/./smtp-parser.h	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/./smtp-address.h	1
dovecotlib-smtp/../..lib/mempool.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-mail/message-id.c	3
dovecotlib-storage/mail-user.h	1
pigeonholetestsuite/testsuite-result.c	3
pigeonholelib-sieve/sieve-execute.c	4
dovecotlib-smtp/../..lib/str.h	5
pigeonholelib-sieve/sieve-result.c	7
pigeonholelib-sieve/sieve-message.c	6
pigeonholelib-sieve/util/edit-mail.c	5
pigeonholelib-sieve/sieve-interpreter.c	12
pigeonholelib-sieve/./sieve-runtime-trace.h	5
pigeonholelib-sieve/sieve-runtime-trace.c	9
dovecotlib/cpu-limit.c	8
pigeonholelib-sieve/sieve-code.c	1
dovecotlib-storage/mail-search-register.c	1
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib/iostream-pump.c	3