Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzer details

Fuzzer: exprtk_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1837 52.4%
gold [1:9] 297 8.48%
yellow [10:29] 77 2.19%
greenyellow [30:49] 48 1.37%
lawngreen 50+ 1243 35.4%
All colors 3502 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
165533 184820 37 :

['exprtk::parser ::symtab_store::get_variable(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::parse_vector()', 'exprtk::parser_error::type::~type()', 'exprtk::details::to_str(int)', 'exprtk::symbol_table ::create_variable(std::__1::basic_string , std::__1::allocator > const&, double const&)', 'exprtk::lexer::parser_helper::current_token() const', 'exprtk::parser ::expression_generator ::operator()(double const&) const', 'exprtk::parser ::parse_string_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::set_error(exprtk::parser_error::type const&)', 'exprtk::parser ::symtab_store::get_string_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::is_stringvar(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::symbol_table ::add_constant(std::__1::basic_string , std::__1::allocator > const&, double const&)', 'exprtk::parser ::symtab_store::get_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::is_vector(std::__1::basic_string , std::__1::allocator > const&) const', 'std::__1::basic_string , std::__1::allocator >::basic_string (char const*)', 'exprtk::parser ::parse_symtab_symbol()', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', 'exprtk::parser ::settings_store::function_enabled(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser_error::make_error(exprtk::parser_error::error_mode, exprtk::lexer::token const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::settings_store::rsrvd_sym_usr_disabled() const', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::parse_vararg_function_call(exprtk::ivararg_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::details::is_reserved_symbol(std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, std::__1::basic_string , std::__1::allocator >&&)', 'exprtk::parser ::parse_generic_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::symtab_store::get_symbol_table(unsigned long const&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)', 'exprtk::parser ::symtab_store::is_constant_node(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::parse_string()', 'std::__1::basic_string , std::__1::allocator >::empty() const', 'exprtk::parser ::parse_function_invocation(exprtk::ifunction *, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator >::basic_string()', 'exprtk::details::is_base_function(std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::parse_overload_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::symtab_store::get_overload_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::get_vararg_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::get_generic_function(std::__1::basic_string , std::__1::allocator > const&) const']

165533 185086 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26758
165533 184820 37 :

['exprtk::parser ::parse_string_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::parse_function_invocation(exprtk::ifunction *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::parse_string()', 'exprtk::parser_error::type::~type()', 'exprtk::parser ::parse_vector()', 'exprtk::parser ::expression_generator ::operator()(float const&) const', 'exprtk::details::to_str(int)', 'exprtk::parser ::symtab_store::get_generic_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::lexer::parser_helper::current_token() const', 'exprtk::parser ::symtab_store::is_vector(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::is_constant_node(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::settings_store::rsrvd_sym_usr_disabled() const', 'exprtk::parser ::symtab_store::get_variable(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::is_stringvar(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::set_error(exprtk::parser_error::type const&)', 'std::__1::basic_string , std::__1::allocator >::basic_string (char const*)', 'exprtk::parser ::parse_overload_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::symtab_store::get_vararg_function(std::__1::basic_string , std::__1::allocator > const&) const', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, char const*)', 'exprtk::symbol_table ::add_constant(std::__1::basic_string , std::__1::allocator > const&, float const&)', 'exprtk::parser_error::make_error(exprtk::parser_error::error_mode, exprtk::lexer::token const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::parse_vararg_function_call(exprtk::ivararg_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::symtab_store::get_symbol_table(unsigned long const&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::details::is_reserved_symbol(std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(std::__1::basic_string , std::__1::allocator >&&, std::__1::basic_string , std::__1::allocator >&&)', 'exprtk::parser ::parse_generic_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)', 'exprtk::parser ::settings_store::function_enabled(std::__1::basic_string , std::__1::allocator > const&) const', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator >&&)', 'exprtk::parser ::symtab_store::get_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::symtab_store::get_overload_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::parser ::parse_symtab_symbol()', 'std::__1::basic_string , std::__1::allocator >::empty() const', 'std::__1::basic_string , std::__1::allocator >::basic_string()', 'exprtk::symbol_table ::create_variable(std::__1::basic_string , std::__1::allocator > const&, float const&)', 'exprtk::parser ::symtab_store::get_string_function(std::__1::basic_string , std::__1::allocator > const&) const', 'exprtk::details::is_base_function(std::__1::basic_string , std::__1::allocator > const&)']

165533 185086 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26758
18623 18623 1 :

['exprtk::parser ::parse_define_vector_statement(std::__1::basic_string , std::__1::allocator > const&)']

18623 18623 exprtk::parser ::parse_define_var_statement() call site /src/exprtk/./exprtk.hpp:26090
18623 18623 1 :

['exprtk::parser ::parse_define_vector_statement(std::__1::basic_string , std::__1::allocator > const&)']

18623 18623 exprtk::parser ::parse_define_var_statement() call site /src/exprtk/./exprtk.hpp:26090
18517 18517 1 :

['exprtk::parser ::parse_swap_statement()']

18517 18517 exprtk::parser ::parse_symbol() call site /src/exprtk/./exprtk.hpp:27127
18517 18517 1 :

['exprtk::parser ::parse_swap_statement()']

18517 18517 exprtk::parser ::parse_symbol() call site /src/exprtk/./exprtk.hpp:27127
18424 18424 1 :

['exprtk::parser ::parse_generic_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)']

18432 18496 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26847
18424 18424 1 :

['exprtk::parser ::parse_generic_function_call(exprtk::igeneric_function *, std::__1::basic_string , std::__1::allocator > const&)']

18432 18496 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26847
18422 18422 1 :

['exprtk::parser ::parse_return_statement()']

18422 18422 exprtk::parser ::parse_symbol() call site /src/exprtk/./exprtk.hpp:27133
18422 18422 1 :

['exprtk::parser ::parse_return_statement()']

18422 18422 exprtk::parser ::parse_symbol() call site /src/exprtk/./exprtk.hpp:27133
18408 18408 1 :

['exprtk::parser ::parse_vararg_function_call(exprtk::ivararg_function *, std::__1::basic_string , std::__1::allocator > const&)']

18416 18480 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26821
18408 18408 1 :

['exprtk::parser ::parse_vararg_function_call(exprtk::ivararg_function *, std::__1::basic_string , std::__1::allocator > const&)']

18416 18480 exprtk::parser ::parse_symtab_symbol() call site /src/exprtk/./exprtk.hpp:26821

Runtime coverage analysis

Covered functions
22088
Functions that are reachable but not covered
2292
Reachable functions
4557
Percentage of reachable functions covered
49.7%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/exprtk_fuzzer.cpp 3
/src/exprtk/./exprtk.hpp 838
/usr/include/ctype.h 3

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,doubleconst&,doubleconst,doubleconst,doubleconst&) 41 21 51.21% []
exprtk::lexer::token::to_str(exprtk::lexer::token::token_type) 45 6 13.33% ['exprtk_fuzzer']
exprtk::parser ::parse_multi_switch_statement() 86 14 16.27% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::vararg_function *>,std::__1::vector>(exprtk::details::operator_typeconst&,std::__1::vector *,std::__1::allocator *>>&) 42 22 52.38% ['exprtk_fuzzer']
doubleexprtk::details::numeric::details::process_impl (exprtk::details::operator_type,double) 47 18 38.29% []
exprtk::parser ::expression_generator ::synthesize_assignment_expression(exprtk::details::operator_typeconst&,exprtk::details::expression_node *(&)[2]) 47 20 42.55% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::lodge_assignment(exprtk::parser ::symbol_type,exprtk::details::expression_node *) 35 4 11.42% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::synthesize_assignment_operation_expression(exprtk::details::operator_typeconst&,exprtk::details::expression_node *(&)[2]) 134 14 10.44% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,doubleconst,doubleconst,doubleconst&,doubleconst) 41 10 24.39% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,doubleconst,doubleconst,doubleconst&,doubleconst&) 41 12 29.26% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,doubleconst,doubleconst&,doubleconst,doubleconst) 41 7 17.07% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,doubleconst&,doubleconst&,doubleconst,doubleconst) 41 10 24.39% ['exprtk_fuzzer']
exprtk::parser ::parse_conditional_statement_01(exprtk::details::expression_node *) 100 42 42.0% ['exprtk_fuzzer']
exprtk::parser ::parse_conditional_statement_02(exprtk::details::expression_node *) 150 60 40.0% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::while_loop(exprtk::details::expression_node *&,exprtk::details::expression_node *&,bool)const 38 20 52.63% ['exprtk_fuzzer']
exprtk::parser ::parse_repeat_until_loop() 119 32 26.89% ['exprtk_fuzzer']
exprtk::parser ::parse_for_loop() 197 70 35.53% ['exprtk_fuzzer']
exprtk::parser ::parse_switch_statement() 130 15 11.53% ['exprtk_fuzzer']
exprtk::parser ::parse_special_function() 35 17 48.57% ['exprtk_fuzzer']
exprtk::parser ::parse_special_function_impl ::process(exprtk::parser &,exprtk::details::operator_type,std::__1::basic_string ,std::__1::allocator >const&) 49 15 30.61% ['exprtk_fuzzer']
exprtk::parser ::parse_break_statement() 60 22 36.66% ['exprtk_fuzzer']
exprtk::parser ::parse_uninitialised_var_statement(std::__1::basic_string ,std::__1::allocator >const&) 70 13 18.57% ['exprtk_fuzzer']
exprtk::parser ::parse_symtab_symbol() 241 79 32.78% ['exprtk_fuzzer']
exprtk::parser ::parse_string_range_statement(exprtk::details::expression_node *&) 35 14 40.0% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,floatconst&,floatconst,floatconst,floatconst&) 41 21 51.21% []
exprtk::parser ::parse_multi_switch_statement() 86 14 16.27% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::vararg_function *>,std::__1::vector>(exprtk::details::operator_typeconst&,std::__1::vector *,std::__1::allocator *>>&) 42 22 52.38% ['exprtk_fuzzer']
floatexprtk::details::numeric::details::process_impl (exprtk::details::operator_type,float) 47 18 38.29% []
exprtk::parser ::expression_generator ::synthesize_assignment_expression(exprtk::details::operator_typeconst&,exprtk::details::expression_node *(&)[2]) 47 20 42.55% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::lodge_assignment(exprtk::parser ::symbol_type,exprtk::details::expression_node *) 35 4 11.42% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::synthesize_assignment_operation_expression(exprtk::details::operator_typeconst&,exprtk::details::expression_node *(&)[2]) 134 14 10.44% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,floatconst,floatconst,floatconst&,floatconst) 41 10 24.39% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,floatconst,floatconst,floatconst&,floatconst&) 41 12 29.26% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,floatconst,floatconst&,floatconst,floatconst) 41 7 17.07% ['exprtk_fuzzer']
exprtk::details::expression_node *exprtk::parser ::expression_generator ::synthesize_sf4ext_expression::process (exprtk::parser ::expression_generator &,exprtk::details::operator_typeconst&,floatconst&,floatconst&,floatconst,floatconst) 41 10 24.39% ['exprtk_fuzzer']
exprtk::parser ::parse_conditional_statement_01(exprtk::details::expression_node *) 100 42 42.0% ['exprtk_fuzzer']
exprtk::parser ::parse_conditional_statement_02(exprtk::details::expression_node *) 150 60 40.0% ['exprtk_fuzzer']
exprtk::parser ::expression_generator ::while_loop(exprtk::details::expression_node *&,exprtk::details::expression_node *&,bool)const 38 20 52.63% ['exprtk_fuzzer']
exprtk::parser ::parse_repeat_until_loop() 119 32 26.89% ['exprtk_fuzzer']
exprtk::parser ::parse_for_loop() 197 70 35.53% ['exprtk_fuzzer']
exprtk::parser ::parse_switch_statement() 130 15 11.53% ['exprtk_fuzzer']
exprtk::parser ::parse_special_function() 35 17 48.57% ['exprtk_fuzzer']
exprtk::parser ::parse_special_function_impl ::process(exprtk::parser &,exprtk::details::operator_type,std::__1::basic_string ,std::__1::allocator >const&) 49 15 30.61% ['exprtk_fuzzer']
exprtk::parser ::parse_break_statement() 60 22 36.66% ['exprtk_fuzzer']
exprtk::parser ::parse_uninitialised_var_statement(std::__1::basic_string ,std::__1::allocator >const&) 70 13 18.57% ['exprtk_fuzzer']
exprtk::parser ::parse_symtab_symbol() 241 79 32.78% ['exprtk_fuzzer']
exprtk::parser ::parse_string_range_statement(exprtk::details::expression_node *&) 35 14 40.0% ['exprtk_fuzzer']