High level conclusions

Fuzzers reach 32.01% of cyclomatic complexity.

Fuzzers reach 30.27% of all functions.

Fuzzer fuzz-suite is blocked:

The runtime code coverage of fuzz-suite covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz-imap-bodystructure is blocked:

The runtime code coverage of fuzz-imap-bodystructure covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3464 / 11440

Cyclomatic complexity statically reachable by fuzzers

19578 / 61145

Runtime code coverage of functions

2003 / 11440

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-qp-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	691	71.8%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	269	27.9%
All colors	962	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
76	150	buffer_check_limits	call site: 00150	event_want_level
68	295	i_snprintf	call site: 00295	t_push
58	808	i_close_fd_path	call site: 00808	io_remove
55	426	buffer_copy	call site: 00426	str_vprintfa
37	766	iostream_pump_destroy	call site: 00766	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	395	buffer_set_used_size	call site: 00395	event_want_level
28	656	buffer_delete	call site: 00656	signal_shadow
22	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event
13	244	printf_format_fix_noalloc	call site: 00244	t_buffer_get

Runtime coverage analysis

Covered functions

117

Functions that are reachable but not covered

218

Reachable functions

331

Percentage of reachable functions covered

34.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-qp-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib/hex-binary.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-date

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	628	64.8%
gold	[1:9]	4	0.41%
yellow	[10:29]	6	0.61%
greenyellow	[30:49]	5	0.51%
lawngreen	50+	325	33.5%
All colors	968	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
60	166	event_want_level	call site: 00166	event_filter_match_source
58	814	i_close_fd_path	call site: 00814	io_remove
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
37	772	iostream_pump_destroy	call site: 00772	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

159

Functions that are reachable but not covered

193

Reachable functions

339

Percentage of reachable functions covered

43.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-date.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	10
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-mail/message-date.c	4
dovecotlib-mail/rfc822-parser.c	4
dovecotlib-mail/../..lib/str.h	5
dovecotlib/utc-mktime.c	3
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	649	57.0%
gold	[1:9]	6	0.52%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	16	1.40%
lawngreen	50+	465	40.8%
All colors	1137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
58	983	i_close_fd_path	call site: 00983	io_remove
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
37	941	iostream_pump_destroy	call site: 00941	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
16	878	http_url_parse_path	call site: 00878	uri_data_decode

Runtime coverage analysis

Covered functions

203

Functions that are reachable but not covered

191

Reachable functions

380

Percentage of reachable functions covered

49.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-url/fuzz-http-url.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	710	63.9%
gold	[1:9]	2	0.18%
yellow	[10:29]	3	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	396	35.6%
All colors	1111	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	395	buffer_set_used_size	call site: 00395	event_want_level
76	150	buffer_check_limits	call site: 00150	event_want_level
68	295	i_snprintf	call site: 00295	t_push
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
41	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
37	917	iostream_pump_destroy	call site: 00917	io_loop_destroy
34	981	array_get_modifiable_i	call site: 00981	t_strdup_printf
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	365	buffer_check_append_limits	call site: 00365	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
18	959	i_close_fd_path	call site: 00959	io_remove
13	244	printf_format_fix_noalloc	call site: 00244	t_buffer_get

Runtime coverage analysis

Covered functions

194

Functions that are reachable but not covered

222

Reachable functions

393

Percentage of reachable functions covered

43.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-parser.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	22
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	4
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-imap/imap-parser.c	31
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	8
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-bodystructure

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1415	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	1415	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1414	0	EP	call site: 00000	imap_bodystructure_parse_full

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

438

Reachable functions

438

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-bodystructure.c	6
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	22
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	13
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	26
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	5
dovecotlib/memarea.c	2
dovecotlib-imap/imap-bodystructure.c	14
dovecotlib/istream-data.c	1
dovecotlib-imap/imap-parser.c	24
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib-imap/../..lib/mempool.h	3
dovecotlib-imap/../..lib/array.h	7
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/strescape.c	1
dovecotlib/ostream.c	9
dovecotlib-imap/imap-arg.c	6
dovecotlib-imap/imap-envelope.c	5
dovecotlib-imap/../..lib/str.h	5
dovecotlib-imap/imap-quote.c	7
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-mail/message-part.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-uri-util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	647	60.9%
gold	[1:9]	6	0.56%
yellow	[10:29]	3	0.28%
greenyellow	[30:49]	4	0.37%
lawngreen	50+	402	37.8%
All colors	1062	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
58	908	i_close_fd_path	call site: 00908	io_remove
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
37	866	iostream_pump_destroy	call site: 00866	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
17	793	uri_parse_pct_encoded_data	call site: 00793	uri_parse_pct_encoded

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

189

Reachable functions

366

Percentage of reachable functions covered

48.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-url/fuzz-uri-util.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-url/uri-util.c	24
dovecotlib-url/../..lib/str.h	4
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-request-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	683	43.9%
gold	[1:9]	6	0.38%
yellow	[10:29]	24	1.54%
greenyellow	[30:49]	15	0.96%
lawngreen	50+	826	53.1%
All colors	1554	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
38	1420	array_idx_i	call site: 01420	t_strdup_printf
37	1360	iostream_pump_destroy	call site: 01360	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
21	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

369

Functions that are reachable but not covered

190

Reachable functions

508

Percentage of reachable functions covered

62.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-request-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	6
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	8
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	30
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-request-parser.c	13
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-url/http-url.c	13
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/./http-parser.h	3
dovecotlib-http/../..lib/str.h	4
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib-http/http-request.c	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-http/../..lib-url/uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-pointer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	62.1%
gold	[1:9]	2	0.20%
yellow	[10:29]	2	0.20%
greenyellow	[30:49]	4	0.40%
lawngreen	50+	366	37.0%
All colors	989	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
58	835	i_close_fd_path	call site: 00835	io_remove
56	166	event_want_level	call site: 00166	event_filter_match_source
48	295	i_snprintf	call site: 00295	t_push
39	395	buffer_set_used_size	call site: 00395	event_want_level
37	793	iostream_pump_destroy	call site: 00793	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
22	438	t_memdup_noconst	call site: 00438	event_get_log_message_str_out
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

172

Functions that are reachable but not covered

184

Reachable functions

343

Percentage of reachable functions covered

46.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-pointer.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	3
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	11
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-json/json-pointer.c	5
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	2
dovecotlib-json/../..lib/str.h	2
dovecotlib-url/uri-util.c	7
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/str.h	3
dovecotlib/numpack.c	1
dovecotlib-json/../..lib/lib.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	614	60.1%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	405	39.6%
All colors	1021	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
39	395	buffer_set_used_size	call site: 00395	event_want_level
38	887	array_idx_i	call site: 00887	t_strdup_printf
37	826	iostream_pump_destroy	call site: 00826	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	656	buffer_delete	call site: 00656	signal_shadow
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

273

Functions that are reachable but not covered

177

Reachable functions

356

Percentage of reachable functions covered

50.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	6
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-http-response-parser

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	617	46.5%
gold	[1:9]	2	0.15%
yellow	[10:29]	22	1.65%
greenyellow	[30:49]	4	0.30%
lawngreen	50+	681	51.3%
All colors	1326	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
38	1192	array_idx_i	call site: 01192	t_strdup_printf
37	1132	iostream_pump_destroy	call site: 01132	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
21	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
19	441	str_truncate	call site: 00441	event_get_log_message_str_out
18	1173	i_close_fd_path	call site: 01173	io_remove

Runtime coverage analysis

Covered functions

333

Functions that are reachable but not covered

179

Reachable functions

459

Percentage of reachable functions covered

61.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-http/fuzz-http-response-parser.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	4
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	20
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	8
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-http/http-response-parser.c	10
dovecotlib-http/../..lib/malloc-overflow.h	1
dovecotlib-http/../..lib/mempool.h	4
dovecotlib-http/http-message-parser.c	21
dovecotlib-http/../..lib/istream.h	2
dovecotlib-http/http-header-parser.c	9
dovecotlib-http/../..lib/str.h	5
dovecotlib-http/./http-parser.h	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-http/../..lib/buffer.h	1
dovecotlib-http/http-header.c	4
dovecotlib-http/../..lib/array.h	7
dovecotlib-http/../..lib/lib.h	1
dovecotlib-http/http-parser.c	7
dovecotlib-http/http-date.c	13
dovecotlib/utc-mktime.c	3
dovecotlib-http/http-transfer-chunked.c	1
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	2
dovecotlib/ostream.c	4
dovecotlib-http/./http-header.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-istream-json-string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	685	68.2%
gold	[1:9]	2	0.19%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	316	31.5%
All colors	1003	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	150	buffer_check_limits	call site: 00150	event_want_level
58	849	i_close_fd_path	call site: 00849	io_remove
57	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
41	440	str_truncate	call site: 00440	event_get_log_message_str_out
37	807	iostream_pump_destroy	call site: 00807	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
22	69	t_buffer_alloc	call site: 00069	data_stack_send_grow_event
21	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

205

Reachable functions

354

Percentage of reachable functions covered

42.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-istream-json-string.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	25
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib/istream-data.c	1
dovecotlib-json/istream-json-string.c	2
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	1
dovecotlib-json/json-parser.c	2
dovecotlib-json/../..lib/array.h	2
dovecotlib-json/../..lib/istream.h	2
dovecotlib-json/../..lib/str.h	3
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand-import

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	646	65.5%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	337	34.2%
All colors	985	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
65	395	buffer_set_used_size	call site: 00395	event_want_level
60	166	event_want_level	call site: 00166	event_filter_match_source
58	831	i_close_fd_path	call site: 00831	io_remove
48	295	i_snprintf	call site: 00295	t_push
37	789	iostream_pump_destroy	call site: 00789	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
14	467	event_unref	call site: 00467	event_send
13	767	split_str_fast	call site: 00767	split_str_slow
10	13	random_fill	call site: 00013	random_read

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

198

Reachable functions

341

Percentage of reachable functions covered

41.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand-import.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	16
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	7
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	7
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	2
dovecotlib/strescape.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-message-decoder

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	644	47.5%
gold	[1:9]	2	0.14%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	709	52.3%
All colors	1355	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
50	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
48	295	i_snprintf	call site: 00295	t_push
40	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
37	1164	iostream_pump_destroy	call site: 01164	io_loop_destroy
37	1225	array_idx_i	call site: 01225	t_strdup_printf
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	395	buffer_set_used_size	call site: 00395	event_want_level
28	656	buffer_delete	call site: 00656	signal_shadow
26	196	str_parse_uintmax	call site: 00196	event_match_field
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	441	str_truncate	call site: 00441	event_get_log_message_str_out

Runtime coverage analysis

Covered functions

341

Functions that are reachable but not covered

182

Reachable functions

451

Percentage of reachable functions covered

59.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-mail/fuzz-message-decoder.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	12
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	21
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	23
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	4
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-mail/message-parser.c	9
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	2
dovecotlib-mail/../..lib/array.h	9
dovecotlib-mail/message-decoder.c	10
dovecotlib-mail/../..lib/base64.h	4
dovecotlib/unichar.c	9
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib/./unichar.h	2
dovecotlib-mail/../..lib/istream.h	1
dovecotlib-mail/message-size.c	1
dovecotlib-mail/qp-decoder.c	6
dovecotlib-mail/rfc822-parser.c	7
dovecotlib-mail/../..lib/str.h	6
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-mail/rfc2231-parser.c	11
dovecotlib-charset/charset-utf8.c	7
dovecotlib-mail/message-address.c	1
dovecotlib-mail/message-header-decode.c	5
dovecotlib-mail/quoted-printable.c	1
dovecotlib/hex-binary.c	1
dovecotlib/base64.c	4
dovecotlib/./base64.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/message-header-parser.c	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-json-istream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	765	65.8%
gold	[1:9]	2	0.17%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	393	33.8%
All colors	1161	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	150	buffer_check_limits	call site: 00150	event_want_level
58	1007	i_close_fd_path	call site: 01007	io_remove
57	295	i_snprintf	call site: 00295	t_push
44	395	buffer_set_used_size	call site: 00395	event_want_level
40	441	str_truncate	call site: 00441	event_get_log_message_str_out
37	965	iostream_pump_destroy	call site: 00965	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
29	602	io_stream_free	call site: 00602	lib_signals_ioloop_ref
28	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
28	656	buffer_delete	call site: 00656	signal_shadow
19	375	buffer_nul_terminate	call site: 00375	t_strdup_printf
19	633	array_idx_get_space_i	call site: 00633	signal_read

Runtime coverage analysis

Covered functions

255

Functions that are reachable but not covered

222

Reachable functions

400

Percentage of reachable functions covered

44.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-json/fuzz-json-istream.c	1
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	2
dovecotlib/buffer.c	18
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	30
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib-test/test-istream.c	1
dovecotlib-test/../..lib/malloc-overflow.h	1
dovecotlib-test/../..lib/mempool.h	1
dovecotlib-json/json-istream.c	14
dovecotlib-json/../..lib/malloc-overflow.h	1
dovecotlib-json/../..lib/mempool.h	4
dovecotlib-json/json-parser.c	14
dovecotlib-json/../..lib/array.h	5
dovecotlib-json/./json-types.h	2
dovecotlib-json/json-tree.c	9
dovecotlib-json/../..lib/lib.h	1
dovecotlib-json/../..lib/istream.h	2
dovecotlib/unichar.c	2
dovecotlib/./unichar.h	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-smtp-server

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3492	62.4%
gold	[1:9]	20	0.35%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	2079	37.1%
All colors	5592	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
331	3652	array_get_modifiable_i	call site: 03652	smtp_server_connection_sni_callback
270	3031	str_truncate	call site: 03031	settings_parse_keyidx_value_nodup
203	2315	i_realloc	call site: 02315	settings_default_overrides_update
182	3469	array_get_i	call site: 03469	settings_sort_filter_array
145	2028	array_create_i	call site: 02028	settings_instance_get
142	2782	array_create_i	call site: 02782	var_expand_parser_parse
129	2651	array_clear_i	call site: 02651	settings_instance_override
117	1732	t_strdup_until_noconst	call site: 01732	smtp_server_connection_output
117	4368	str_truncate	call site: 04368	message_address_parse_real
110	4918	smtp_server_cmd_xclient	call site: 04918	cmd_xclient_recheck
82	2221	array_idx_i	call site: 02221	settings_instance_override_init
82	3367	str_truncate	call site: 03367	http_url_parse_authority_form

Runtime coverage analysis

Covered functions

803

Functions that are reachable but not covered

699

Reachable functions

1367

Percentage of reachable functions covered

48.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-smtp/fuzz-smtp-server.c	2
dovecotlib-test/fuzzer.c	4
dovecotlib/lib.c	11
dovecotlib/failures.c	10
dovecotlib/randgen.c	7
dovecotlib/hash.c	21
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	48
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	45
dovecotlib/./array.h	12
dovecotlib/imem.c	5
dovecotlib/buffer.c	24
dovecotlib/mempool.c	2
dovecotlib/event-log.c	14
dovecotlib/event-filter.c	37
dovecotlib/wildcard-match.c	6
dovecotlib/strnum.c	18
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	54
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	28
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
dovecotlib/priorityq.c	12
dovecotlib/istream-data.c	1
dovecotlib/ostream-file.c	5
dovecotlib/ostream.c	34
dovecotlib/iostream-pump.c	10
dovecotlib-smtp/smtp-server.c	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-smtp/./smtp-common.h	1
dovecotlib-smtp/smtp-server-connection.c	54
dovecotlib/connection.c	23
dovecotlib-smtp/smtp-server-command.c	30
dovecotlib-smtp/../..lib/array.h	9
dovecotlib-smtp/smtp-server-cmd-helo.c	7
dovecotlib-smtp/smtp-server-reply.c	24
dovecotlib-smtp/../..lib/str.h	8
dovecotlib-smtp/smtp-command-parser.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	20
dovecotlib-smtp/smtp-server-transaction.c	10
dovecotlib-smtp/smtp-server-recipient.c	17
dovecotlib-smtp/smtp-address.c	16
dovecotlib-smtp/./smtp-address.h	2
dovecotlib-smtp/./smtp-parser.h	7
dovecotlib-smtp/smtp-params.c	27
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	9
dovecotlib/./unichar.h	2
dovecotlib/safe-memset.c	1
dovecotlib/./buffer.h	1
dovecotlib-smtp/./smtp-server-private.h	1
dovecotlib-smtp/smtp-reply-parser.c	1
dovecotlib-smtp/smtp-reply.c	4
dovecotlib-smtp/./smtp-reply.h	1
dovecotlib-smtp/smtp-syntax.c	4
dovecotlib-smtp/smtp-parser.c	12
dovecotlib-smtp/smtp-server-cmd-auth.c	4
dovecotlib-smtp/smtp-server-cmd-starttls.c	5
dovecotlib/iostream-rawlog.c	5
dovecotlib/istream-rawlog.c	2
dovecotlib/ostream-rawlog.c	2
dovecotlib/./time-util.h	3
dovecotlib-smtp/../..lib/ostream.h	1
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-settings/settings.c	58
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/../..lib/array.h	13
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/settings-parser.c	31
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/strescape.c	2
dovecotlib/str-parse.c	6
dovecotlib-settings/settings-bin-filter.c	11
dovecotlib-settings/./settings-bin-filter.h	3
dovecotlib-settings/../..lib/bits.h	1
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/./settings-parser.h	2
dovecotlib-var-expand/expansion-program.c	11
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib/hex-binary.c	2
dovecotlib/read-full.c	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib/primes.c	1
dovecotlib/module-dir.c	23
dovecotlib-smtp/smtp-server-cmd-mail.c	5
dovecotlib-smtp/../..lib/strfuncs.h	2
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-smtp/smtp-server-cmd-rcpt.c	8
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-server-cmd-data.c	21
dovecotlib-mail/istream-dot.c	1
dovecotlib/istream-failure-at.c	1
dovecotlib/istream-chain.c	4
dovecotlib/istream-limit.c	1
dovecotlib/istream-sized.c	3
dovecotlib-smtp/smtp-server-cmd-rset.c	3
dovecotlib-smtp/smtp-server-cmd-vrfy.c	2
dovecotlib-smtp/smtp-server-cmd-noop.c	2
dovecotlib-smtp/smtp-server-cmd-quit.c	1
dovecotlib-smtp/smtp-server-cmd-xclient.c	5
dovecotlib-smtp/../..lib/abnf.h	2
dovecotlib-auth-client/auth-master.c	2
dovecotlib-auth-client/../..lib/abnf.h	3
dovecotlib-smtp/./smtp-command.h	1
dovecotlib/guid.c	2
dovecotlib/sha1.c	6
dovecotlib-smtp/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	2
dovecotlib/ostream-unix.c	1
dovecotlib/sleep.c	2
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-var-expand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	758	64.7%
gold	[1:9]	2	0.17%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	409	34.9%
All colors	1170	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
48	295	i_snprintf	call site: 00295	t_push
38	1039	array_idx_i	call site: 01039	t_strdup_printf
37	978	iostream_pump_destroy	call site: 00978	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	166	event_want_level	call site: 00166	event_filter_match_source
28	656	buffer_delete	call site: 00656	signal_shadow
28	806	uni_utf8_parse_char	call site: 00806	append_valid_utf8
26	196	str_parse_uintmax	call site: 00196	event_match_field
23	395	buffer_set_used_size	call site: 00395	event_want_level
22	438	t_memdup_noconst	call site: 00438	event_get_log_message_str_out
20	887	array_sort_i	call site: 00887	create_literal

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

199

Reachable functions

404

Percentage of reachable functions covered

50.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-var-expand/fuzz-var-expand.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	23
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	15
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	13
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	6
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-var-expand/expansion-program.c	2
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	3
dovecotlib-var-expand/../..lib/array.h	5
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	3
dovecotlib/unichar.c	5
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-imap-utf7

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	629	64.6%
gold	[1:9]	2	0.20%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	342	35.1%
All colors	973	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
65	395	buffer_set_used_size	call site: 00395	event_want_level
60	166	event_want_level	call site: 00166	event_filter_match_source
58	819	i_close_fd_path	call site: 00819	io_remove
48	295	i_snprintf	call site: 00295	t_push
37	777	iostream_pump_destroy	call site: 00777	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
28	366	buffer_check_append_limits	call site: 00366	t_strdup_printf
28	656	buffer_delete	call site: 00656	signal_shadow
14	467	event_unref	call site: 00467	event_send
10	13	random_fill	call site: 00013	random_read
10	26	fd_close_on_exec	call site: 00026	random_read

Runtime coverage analysis

Covered functions

162

Functions that are reachable but not covered

193

Reachable functions

342

Percentage of reachable functions covered

43.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-imap/fuzz-imap-utf7.c	1
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	9
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	1
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	20
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	26
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	6
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	9
dovecotlib/./array.h	11
dovecotlib/imem.c	1
dovecotlib/buffer.c	19
dovecotlib/mempool.c	1
dovecotlib/event-log.c	12
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	4
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	5
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	5
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-imap/imap-utf7.c	9
dovecotlib-imap/../..lib/str.h	6
dovecotlib-imap/../..lib/malloc-overflow.h	1
dovecotlib/hex-dec.c	1
dovecotlib/unichar.c	3
dovecotlib/./unichar.h	2
dovecotlib-imap/../..lib/unichar.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-sasl-authentication

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2319	69.4%
gold	[1:9]	12	0.35%
yellow	[10:29]	3	0.08%
greenyellow	[30:49]	6	0.17%
lawngreen	50+	997	29.8%
All colors	3337	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
225	2251	i_close_fd_path	call site: 02251	settings_parse_keyidx_value_nodup
220	1281	p_strdup_until	call site: 01281	settings_instance_override_init
217	2647	array_get_i	call site: 02647	settings_sort_filter_array
130	1951	array_create_i	call site: 01951	var_expand_parser_parse
126	1530	t_strconcat	call site: 01530	settings_default_overrides_update
112	2086	p_strconcat	call site: 02086	var_expand_program_execute
99	1850	p_strdup_printf	call site: 01850	settings_var_expand
85	1714	array_sort_i	call site: 01714	settings_mmap_apply
84	1195	t_strdup_until_noconst	call site: 01195	settings_instance_get
79	2543	str_truncate	call site: 02543	http_url_parse_authority_form
64	2478	array_delete_i	call site: 02478	http_url_parse
48	295	i_snprintf	call site: 00295	t_push

Runtime coverage analysis

Covered functions

658

Functions that are reachable but not covered

486

Reachable functions

843

Percentage of reachable functions covered

42.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-sasl/fuzz-sasl-authentication.c	6
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	10
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	13
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	23
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	40
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	3
dovecotlib/strfuncs.c	42
dovecotlib/./array.h	11
dovecotlib/imem.c	5
dovecotlib/buffer.c	21
dovecotlib/mempool.c	2
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	37
dovecotlib/wildcard-match.c	6
dovecotlib/strnum.c	17
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	10
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	7
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	2
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	21
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	29
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	8
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	6
dovecotlib/memarea.c	2
dovecotlib/./lib-event-private.h	1
dovecotlib-auth/password-scheme.c	4
dovecotlib/primes.c	1
dovecotlib/istream-data.c	1
dovecotlib/priorityq.c	8
dovecotlib-sasl/sasl-server.c	4
dovecotlib-sasl/../..lib/malloc-overflow.h	1
dovecotlib-sasl/../..lib/mempool.h	2
dovecotlib-sasl/sasl-server-mech-anonymous.c	1
dovecotlib-sasl/sasl-server-mech.c	16
dovecotlib-sasl/sasl-server-mech-cram-md5.c	1
dovecotlib-sasl/sasl-server-mech-digest-md5.c	1
dovecotlib-sasl/sasl-server-mech-login.c	1
dovecotlib-sasl/sasl-server-mech-plain.c	1
dovecotlib-sasl/sasl-server-mech-scram.c	5
dovecotlib-sasl/sasl-server-mech-oauth2.c	3
dovecotlib/str-sanitize.c	4
dovecotlib/unichar.c	9
dovecotlib/./unichar.h	2
dovecotlib-sasl/dsasl-client.c	17
dovecotlib-sasl/../..lib/array.h	6
dovecotlib-sasl/sasl-server-request.c	12
dovecotlib-sasl/sasl-common.c	1
dovecotlib-auth/client-auth-settings.c	1
dovecotlib-auth/../..lib/mempool.h	2
dovecotlib-auth/../..lib/malloc-overflow.h	1
dovecotlib-sasl/../..lib/lib.h	1
dovecotlib-settings/settings.c	58
dovecotlib-settings/../..lib/array.h	13
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/settings-parser.c	31
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/../..lib/strfuncs.h	2
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/strescape.c	2
dovecotlib/str-parse.c	6
dovecotlib-settings/settings-bin-filter.c	11
dovecotlib-settings/./settings-bin-filter.h	3
dovecotlib-settings/../..lib/bits.h	1
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/./settings-parser.h	2
dovecotlib-var-expand/expansion-program.c	11
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib/hex-binary.c	2
dovecotlib/read-full.c	1
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-sasl/../..lib/str.h	4
dovecotlib-sasl/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-sasl/../..lib/istream.h	1
dovecotlib-sasl/../..lib/buffer.h	1
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/ipwd.c	1
dovecotlib/restrict-access.c	1
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-mail-search-args-simplify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1084	49.7%
gold	[1:9]	7	0.32%
yellow	[10:29]	7	0.32%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1081	49.6%
All colors	2179	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
209	1758	mail_transaction_log_close	call site: 01758	mail_transaction_log_file_free
110	542	lib_signals_init	call site: 00542	lib_signals_ioloop_switch
102	1632	mail_search_arg_to_imap	call site: 01632	mail_search_mime_part_to_imap
48	295	i_snprintf	call site: 00295	t_push
36	2053	array_idx_i	call site: 02053	t_strdup_printf
35	1994	fuzzer_deinit	call site: 01994	io_loop_destroy
32	258	t_malloc_real	call site: 00258	t_strdup_printf
32	1387	mailbox_keywords_create_skip	call site: 01387	imap_match_init
28	656	buffer_delete	call site: 00656	signal_shadow
27	166	event_want_level	call site: 00166	event_filter_match_source
26	196	str_parse_uintmax	call site: 00196	event_match_field
25	395	buffer_set_used_size	call site: 00395	event_want_level

Runtime coverage analysis

Covered functions

548

Functions that are reachable but not covered

259

Reachable functions

638

Percentage of reachable functions covered

59.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
dovecotlib-storage/fuzz-mail-search-args-simplify.c	15
dovecotlib-test/fuzzer.c	3
dovecotlib/lib.c	10
dovecotlib/failures.c	9
dovecotlib/randgen.c	7
dovecotlib/hash.c	18
dovecotlib/fd-util.c	2
dovecotlib/./lib.h	1
dovecotlib/data-stack.c	21
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	32
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	2
dovecotlib/strfuncs.c	27
dovecotlib/./array.h	14
dovecotlib/imem.c	4
dovecotlib/buffer.c	22
dovecotlib/mempool.c	1
dovecotlib/event-log.c	13
dovecotlib/event-filter.c	25
dovecotlib/wildcard-match.c	4
dovecotlib/strnum.c	5
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	4
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	6
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	6
dovecotlib/./strfuncs.h	1
dovecotlib/hostpid.c	2
dovecotlib/lib-signals.c	18
dovecotlib/ioloop.c	19
dovecotlib/ioloop-notify-inotify.c	2
dovecotlib/ioloop-notify-fd.c	1
dovecotlib/istream.c	5
dovecotlib/ioloop-epoll.c	5
dovecotlib/array.c	9
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	2
dovecotlib/memarea.c	1
dovecotlib-storage/mail-storage.c	5
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	6
dovecotlib-storage/mail-storage-hooks.c	3
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-settings/settings.c	3
dovecotlib-settings/../..lib/array.h	5
dovecotlib-settings/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/mail-search-parser-cmdline.c	1
dovecotlib-storage/../..lib/mempool.h	3
dovecotlib-storage/mail-search-register-imap.c	4
dovecotlib-storage/mail-search-register.c	7
dovecotlib-storage/mail-search-build.c	8
dovecotlib-imap/imap-seqset.c	3
dovecotlib/seq-range-array.c	12
dovecotlib/restrict-process-size.c	1
dovecotlib-storage/mail-search-parser.c	3
dovecotlib-charset/charset-utf8.c	4
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib-storage/mail-search.c	12
dovecotlib-storage/mailbox-keywords.c	5
dovecotlib-index/mail-index.c	14
dovecotlib-index/../..lib/mempool.h	3
dovecotlib-imap/imap-match.c	7
dovecotlib-imap/../..lib/mempool.h	2
dovecotlib-storage/mailbox-search-result.c	1
dovecotlib-index/../..lib/malloc-overflow.h	2
dovecotlib/./lib-event-private.h	1
dovecotlib-index/../..lib/array.h	8
dovecotlib/primes.c	1
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-index/mail-transaction-log.c	4
dovecotlib-index/mail-index-modseq.c	1
dovecotlib-storage/mailbox-get.c	1
dovecotlib-index/mail-index-view.c	1
dovecotlib/./seq-range-array.h	1
dovecotlib-storage/mail-search-args-simplify.c	24
dovecotlib-storage/mail-search-mime.c	7
dovecotlib-storage/mail-namespace.c	1
dovecotlib-imap/../..lib/malloc-overflow.h	2
dovecotlib-imap/../..lib/lib.h	1
dovecotlib/unichar.c	5
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib/crc32.c	2
dovecotlib-storage/../..lib/crc32.h	1
dovecotlib-storage/mail-search-args-imap.c	5
dovecotlib-storage/../..lib/str.h	4
dovecotlib-imap/imap-util.c	2
dovecotlib-imap/../..lib/array.h	2
dovecotlib-imap/../..lib/str.h	5
dovecotlib-storage/../..lib/bits.h	1
dovecotlib-imap/imap-arg.c	1
dovecotlib/utc-offset.c	1
dovecotlib-imap/imap-date.c	2
dovecotlib-imap/imap-quote.c	5
dovecotlib-storage/mail-thread.c	1
dovecotlib-index/mail-transaction-log-file.c	2
dovecotlib/nfs-workarounds.c	7
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib/eacces-error.c	7
dovecotlib/path-util.c	2
dovecotlib/ipwd.c	5
dovecotlib/restrict-access.c	2
dovecotlib/iostream-pump.c	3
dovecotlib/ostream.c	3
dovecotlib/priorityq.c	7
dovecotlib/process-title.c	1
dovecotlib/env-util.c	1

Fuzzer: fuzz-suite

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12369	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	12369	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12368	0	EP	call site: 00000	testsuite_message_init

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

2735

Reachable functions

2735

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
pigeonholetestsuite/fuzzsuite.c	2
dovecotlib-test/fuzzer.c	2
dovecotlib/lib.c	13
dovecotlib/failures.c	42
dovecotlib/randgen.c	7
dovecotlib/hash.c	28
dovecotlib/fd-util.c	4
dovecotlib/./lib.h	2
dovecotlib/data-stack.c	24
dovecotlib/./malloc-overflow.h	2
dovecotlib/bits.c	1
dovecotlib/./bits.h	1
dovecotlib/lib-event.c	70
dovecotlib/mempool-alloconly.c	2
dovecotlib/./mempool.h	7
dovecotlib/time-util.c	6
dovecotlib/strfuncs.c	49
dovecotlib/./array.h	13
dovecotlib/imem.c	8
dovecotlib/buffer.c	28
dovecotlib/mempool.c	2
dovecotlib/event-log.c	18
dovecotlib/event-filter.c	40
dovecotlib/wildcard-match.c	7
dovecotlib/strnum.c	28
dovecotlib/printf-format-fix.c	5
dovecotlib/net.c	26
dovecotlib/backtrace-string.c	3
dovecotlib/str.c	8
dovecotlib/mempool-datastack.c	1
dovecotlib/./str.h	8
dovecotlib/./strfuncs.h	3
dovecotlib/hostpid.c	3
dovecotlib/lib-signals.c	27
dovecotlib/ioloop.c	68
dovecotlib/ioloop-notify-inotify.c	7
dovecotlib/ioloop-notify-fd.c	3
dovecotlib/istream.c	41
dovecotlib/ioloop-epoll.c	6
dovecotlib/array.c	10
dovecotlib/ioloop-iolist.c	2
dovecotlib/iostream.c	11
dovecotlib/memarea.c	2
pigeonholelib-sieve-tool/sieve-tool.c	11
dovecotlib/malloc-overflow.h	1
dovecotlib/mempool.h	4
dovecotlib-master/master-service.c	77
dovecotlib/restrict-access.c	17
dovecotlib/./abnf.h	2
dovecotlib/process-title.c	8
dovecotlib/env-util.c	3
dovecotlib-master/../..lib/malloc-overflow.h	1
dovecotlib-master/../..lib/mempool.h	3
dovecotlib-settings/settings.c	82
dovecotlib-settings/../..lib/malloc-overflow.h	2
dovecotlib-settings/../..lib/mempool.h	4
dovecotlib/./lib-event-private.h	1
dovecotlib-master/master-admin-client.c	8
dovecotlib/priorityq.c	12
dovecotlib/./time-util.h	6
dovecotlib/strescape.c	7
dovecotlib-ssl-iostream/iostream-ssl.c	11
dovecotlib/module-dir.c	25
dovecotlib-ssl-iostream/iostream-ssl-context-cache.c	5
dovecotlib-ssl-iostream/../..lib/mempool.h	3
dovecotlib/primes.c	1
dovecotlib/event-filter-lexer.c	17
dovecotlib/event-filter-lexer.l	4
dovecotlib/event-filter-parser.c	5
dovecotlib/event-filter-parser.y	3
dovecotlib/str-parse.c	6
dovecotlib-master/stats-client.c	17
dovecotlib/connection.c	31
dovecotlib/ostream.c	30
dovecotlib-master/../..lib/str.h	6
dovecotlib-master/../..lib/ostream.h	1
dovecotlib/rand.c	2
dovecotlib/istream-unix.c	1
dovecotlib/istream-file.c	3
dovecotlib/ostream-unix.c	1
dovecotlib/ostream-file.c	5
dovecotlib-master/../..lib/time-util.h	1
dovecotlib/sleep.c	3
dovecotlib/array.h	10
pigeonholetestsuite/testsuite-common.c	10
dovecotlib/unlink-directory.c	3
dovecotlib/path-util.c	5
dovecotlib-master/master-instance.c	10
dovecotlib-master/../..lib/array.h	10
dovecotlib/file-dotlock.c	24
dovecotlib/file-lock.c	20
dovecotlib/ipwd.c	7
dovecotlib/nfs-workarounds.c	18
dovecotlib/write-full.c	3
dovecotlib/safe-mkstemp.c	8
dovecotlib/hex-binary.c	3
dovecotlib/eacces-error.c	8
dovecotlib-settings/../..lib/array.h	13
dovecotlib-master/master-service-settings.c	14
dovecotlib/sha2.c	4
dovecotlib-var-expand/var-expand.c	10
dovecotlib-var-expand/expansion-program.c	12
dovecotlib-var-expand/../..lib/malloc-overflow.h	1
dovecotlib-var-expand/../..lib/mempool.h	4
dovecotlib-var-expand/../..lib/array.h	6
dovecotlib/mempool-allocfree.c	1
dovecotlib-var-expand/var-expand-lexer.c	17
dovecotlib-var-expand/var-expand-lexer.l	6
dovecotlib-var-expand/var-expand-parser.c	5
dovecotlib-var-expand/../..lib/str.h	7
dovecotlib/unichar.c	12
dovecotlib/./unichar.h	2
dovecotlib-var-expand/../..lib/lib.h	1
dovecotlib-var-expand/var-expand-parser.y	8
dovecotlib-var-expand/expansion-statement.c	1
dovecotlib-var-expand/expansion-filter.c	1
dovecotlib-master/../..lib/buffer.h	1
dovecotlib/execv-const.c	2
dovecotlib/fdpass.c	1
dovecotlib-master/./storage-version.h	1
dovecotlib/version.c	2
dovecotlib-settings/settings-history.c	8
dovecotlib-settings/../..lib/strfuncs.h	3
dovecotlib-master/../..lib/strfuncs.h	1
dovecotlib/mmap-util.c	3
dovecotlib/xxh64.c	6
dovecotlib/./byteorder.h	6
dovecotlib/./xxh64.h	1
dovecotlib-settings/../..lib/lib.h	1
dovecotlib-settings/settings-bin-filter.c	21
dovecotlib-settings/../..lib/bits.h	2
dovecotlib-settings/settings-parser.c	32
dovecotlib-settings/../..lib/str.h	5
dovecotlib-settings/./settings-bin-filter.h	3
dovecotlib-dns/dns-util.c	1
dovecotlib-dns/./dns-util.h	1
dovecotlib-settings/./settings-parser.h	2
dovecotlib/read-full.c	2
dovecotlib/unicode-transform.c	4
dovecotlib/./unicode-transform.h	4
dovecotlib-url/http-url.c	11
dovecotlib-url/./http-url.h	1
dovecotlib-url/uri-util.c	25
dovecotlib-url/../..lib/malloc-overflow.h	1
dovecotlib-url/../..lib/mempool.h	1
dovecotlib-url/../..lib/str.h	5
dovecotlib-url/./uri-util.h	1
dovecotlib-url/../..lib/array.h	7
dovecotlib-master/master-service-haproxy.c	14
dovecotlib-master/../..lib/lib.h	1
dovecotlib-master/../..lib/byteorder.h	1
dovecotlib/str-sanitize.c	4
dovecotlib-master/master-service-ssl.c	2
dovecotlib-ssl-iostream/ssl-settings.c	3
dovecotlib-ssl-iostream/../..lib/malloc-overflow.h	1
dovecotlib-storage/mail-storage-service.c	43
dovecotlib-storage/mail-storage.c	87
dovecotlib-storage/mailbox-attribute.c	4
dovecotlib-storage/../..lib/array.h	13
dovecotlib-storage/../..lib/malloc-overflow.h	1
dovecotlib-storage/mailbox-attribute-internal.c	1
dovecotlib/bsearch-insert-pos.c	2
dovecotlib-storage/mailbox-list.c	30
dovecotlib-storage/mail-storage-hooks.c	13
dovecotlib-storage/mail-storage-register.c	1
dovecotlib-storage/mailbox-list-register.c	1
dovecotlib-storage/list/mailbox-list-index.c	1
dovecotlib-storage/../..lib/lib.h	1
dovecotlib-storage/../..lib/mempool.h	4
dovecotlib-master/syslog-util.c	1
dovecotlib-dict-extra/dict-register.c	2
dovecotlib-dict/dict.c	3
dovecotlib-dict/../..lib/array.h	7
dovecotlib-dict/../..lib/malloc-overflow.h	1
dovecotlib-dict/../..lib/lib.h	1
dovecotlib-storage/../..lib/strfuncs.h	3
dovecotlib-auth-client/auth-master.c	30
dovecotlib-auth-client/../..lib/malloc-overflow.h	1
dovecotlib-auth-client/../..lib/mempool.h	3
dovecotlib/guid.c	3
dovecotlib/sha1.c	6
dovecotlib/safe-memset.c	1
dovecotlib-storage/../..lib/base64.h	3
dovecotlib/base64.c	4
dovecotlib-storage/../..lib/str.h	6
dovecotlib-auth-client/auth-master-request.c	16
dovecotlib-auth-client/../..lib/time-util.h	2
dovecotlib-auth-client/../..lib/array.h	7
dovecotlib-auth-client/../..lib/strfuncs.h	2
dovecotlib-auth-client/../..lib/str.h	4
dovecotlib-storage/mail-user.c	17
dovecotlib/hook-build.c	6
dovecotlib/process-stat.c	12
dovecotlib/buffer-istream.c	1
dovecotlib/./istream.h	2
dovecotlib-storage/mail-namespace.c	24
dovecotlib-fs/fs-api.c	14
dovecotlib-fs/../..lib/mempool.h	2
dovecotlib/stats-dist.c	1
dovecotlib-fs/../..lib/array.h	7
dovecotlib-index/mail-index-alloc-cache.c	5
dovecotlib-index/mail-index.c	27
dovecotlib-index/../..lib/module-context.h	2
dovecotlib-index/../..lib/array.h	13
dovecotlib-index/mail-transaction-log.c	21
dovecotlib-index/../..lib/mempool.h	6
dovecotlib-index/mail-transaction-log-file.c	40
dovecotlib-index/../..lib/strfuncs.h	1
dovecotlib-index/mail-index-lock.c	2
dovecotlib/file-lock-proc.c	25
dovecotlib-index/../..lib/malloc-overflow.h	1
dovecotlib-index/../..lib/lib.h	2
dovecotlib-index/mail-index-modseq.c	13
dovecotlib-index/mail-index-map.c	19
dovecotlib-index/../..lib/buffer.h	1
dovecotlib-index/mail-index-util.c	6
dovecotlib-index/../..lib/byteorder.h	3
dovecotlib-index/mail-index-map-read.c	9
dovecotlib-index/mail-index-sync-update.c	24
dovecotlib-index/mail-index-view.c	15
dovecotlib-index/mail-transaction-log-view.c	14
dovecotlib-index/mail-transaction-log-modseq.c	4
dovecotlib-index/mail-index-sync-ext.c	16
dovecotlib-index/mail-index-sync.c	1
dovecotlib/seq-range-array.c	6
dovecotlib-index/mail-index-sync-keywords.c	7
dovecotlib-index/mail-index-map-hdr.c	6
dovecotlib-index/mail-index-fsck.c	11
dovecotlib-index/mail-index-write.c	4
dovecotlib-index/mail-cache.c	28
dovecotlib/file-cache.c	7
dovecotlib/mmap-anon.c	3
dovecotlib-storage/mailbox-tree.c	10
dovecotlib-index/mailbox-log.c	2
dovecotlib-storage/mail-error.c	2
dovecotlib-fs/../..lib/malloc-overflow.h	1
dovecotlib-fs/../..lib/lib.h	1
pigeonholelib-sieve/sieve.c	18
pigeonholelib-sieve/sieve-error.c	17
pigeonholelib-sieve/sieve-extensions.c	22
pigeonholelib-sieve/sieve-plugins.c	3
pigeonholelib-sieve/sieve-storage.c	13
dovecotlib/lib.h	1
pigeonholetestsuite/testsuite-log.c	7
dovecotlib/str.h	6
pigeonholetestsuite/testsuite-script.c	2
pigeonholetestsuite/testsuite-binary.c	2
pigeonholetestsuite/testsuite-smtp.c	2
dovecotlib/istream-data.c	3
pigeonholelib-sieve/storage/data/sieve-data-script.c	2
pigeonholelib-sieve/sieve-script.c	9
pigeonholelib-sieve/sieve-storage-sync.c	1
pigeonholelib-sieve/sieve-parser.c	8
pigeonholelib-sieve/sieve-lexer.c	12
pigeonholelib-sieve/sieve-ast.c	31
dovecotlib/strfuncs.h	1
pigeonholelib-sieve/./sieve-error-private.h	1
pigeonholelib-sieve/./sieve-lexer.h	5
pigeonholelib-sieve/sieve-validator.c	26
pigeonholelib-sieve/sieve-commands.c	4
pigeonholelib-sieve/sieve-generator.c	6
pigeonholelib-sieve/sieve-binary.c	24
pigeonholelib-sieve/sieve-binary-code.c	11
pigeonholelib-sieve/./sieve-binary-private.h	5
dovecotlib/buffer.h	2
pigeonholelib-sieve/./sieve-binary.h	2
pigeonholelib-sieve/sieve-binary-file.c	6
pigeonholelib-sieve/sieve-binary-debug.c	7
pigeonholelib-sieve/sieve-rusage.c	4
dovecotlib/mkdir-parents.c	6
pigeonholetestsuite/testsuite-mailstore.c	4
pigeonholelib-sieve/util/mail-raw.c	5
dovecotlib-storage/index/raw/raw-storage.c	4
dovecotlib-storage/index/raw/../../../..lib/malloc-overflow.h	1
dovecotlib-storage/index/raw/../../../..lib/mempool.h	1
pigeonholetestsuite/testsuite-message.c	7
dovecotlib/rate-limit.c	1
dovecotlib-storage/./mail-storage-private.h	1
dovecotlib-storage/../..lib/unicode-data.h	3
dovecotlib-storage/list/mailbox-list-iter.c	20
dovecotlib-storage/list/mailbox-list-subscriptions.c	1
dovecotlib-imap/imap-match.c	4
dovecotlib/bitmap.c	3
dovecotlib-imap/../..lib/bitmap.h	2
dovecotlib-imap/../..lib/bits.h	2
dovecotlib/unicode-break.c	2
dovecotlib-imap/../..lib/unichar.h	2
dovecotlib/./unicode-data.h	1
dovecotlib-storage/list/../../..lib/array.h	8
dovecotlib-storage/list/../../..lib/malloc-overflow.h	1
dovecotlib-storage/list/../../..lib/mempool.h	4
dovecotlib-storage/list/../../..lib/lib.h	1
dovecotlib-storage/mail-storage-settings.c	4
dovecotlib-storage/list/../../..lib/strfuncs.h	1
dovecotlib/file-create-locked.c	4
dovecotlib-index/mail-index-transaction.c	6
dovecotlib-index/mail-index-transaction-update.c	10
dovecotlib-index/mail-cache-decisions.c	5
dovecotlib-index/mail-cache-purge.c	15
dovecotlib-index/mail-cache-fields.c	14
dovecotlib-index/mail-index-transaction-view.c	1
dovecotlib-index/mail-index-transaction-finish.c	2
dovecotlib-index/mail-cache-lookup.c	9
dovecotlib-index/mail-cache-transaction.c	2
dovecotlib-storage/mailbox-header.c	3
dovecotlib-storage/mail.c	6
dovecotlib-mail/message-address.c	16
dovecotlib-mail/rfc822-parser.c	10
dovecotlib-mail/../..lib/str.h	5
dovecotlib-mail/../..lib/malloc-overflow.h	1
dovecotlib-mail/../..lib/mempool.h	1
dovecotlib-mail/../..lib/lib.h	1
dovecotlib-mail/./rfc822-parser.h	1
dovecotlib-smtp/smtp-address.c	7
dovecotlib-smtp/./smtp-parser.h	3
dovecotlib-smtp/../..lib/malloc-overflow.h	2
dovecotlib-smtp/./smtp-address.h	1
dovecotlib-smtp/../..lib/mempool.h	1
dovecotlib-smtp/../..lib/lib.h	1
dovecotlib-mail/message-id.c	3
dovecotlib-storage/mail-user.h	1
pigeonholetestsuite/testsuite-result.c	3
pigeonholelib-sieve/sieve-execute.c	4
dovecotlib-smtp/../..lib/str.h	5
pigeonholelib-sieve/sieve-result.c	7
pigeonholelib-sieve/sieve-message.c	6
pigeonholelib-sieve/util/edit-mail.c	5
pigeonholelib-sieve/sieve-interpreter.c	12
pigeonholelib-sieve/./sieve-runtime-trace.h	5
pigeonholelib-sieve/sieve-runtime-trace.c	9
dovecotlib/cpu-limit.c	8
pigeonholelib-sieve/sieve-code.c	1
dovecotlib-storage/mail-search-register.c	1
dovecotlib-storage/mail-search-mime-register.c	1
dovecotlib/iostream-pump.c	3