High level conclusions

Fuzzers reach 40.29% of cyclomatic complexity.

Fuzzers reach 43.21% of all functions.

Fuzzer flb-it-fuzz-engine_fuzzer_OSSFUZZ is blocked:

The runtime code coverage of flb-it-fuzz-engine_fuzzer_OSSFUZZ covers 15.90% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1039/2404

Cyclomatic complexity statically reachable by fuzzers

7540/18713

Runtime code coverage of functions

723 / 2404

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: flb-it-fuzz-ctrace_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/ctrace_fuzzer.c	1

Fuzzer: flb-it-fuzz-base64_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	flb_base64_encode	call site: 00001	/src/fluent-bit/src/flb_base64.c:95
0	0	None	0	0	flb_base64_encode	call site: 00001	/src/fluent-bit/src/flb_base64.c:103

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/base64_fuzzer.c	1
src/flb_base64.c	2

Fuzzer: flb-it-fuzz-msgpack_to_gelf_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	18.9%
gold	[1:9]	2	1.35%
yellow	[10:29]	1	0.67%
greenyellow	[30:49]	1	0.67%
lawngreen	50+	116	78.3%
All colors	148	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00020	/src/fluent-bit/src/flb_log.c:647
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00010	/src/fluent-bit/include/fluent-bit/flb_log.h:105
0	61	2 : View List ['flb_log_check.123', 'flb_log_print']	0	61	flb_sds_printf	call site: 00093	/src/fluent-bit/src/flb_sds.c:446
0	0	None	18	1531	flb_msgpack_to_gelf	call site: 00036	/src/fluent-bit/src/flb_pack_gelf.c:469
0	0	None	2	71	flb_sds_create	call site: 00001	/src/fluent-bit/src/flb_sds.c:81
0	0	None	0	195	flb_sds_printf	call site: 00084	/src/fluent-bit/src/flb_sds.c:422
0	0	None	0	65	flb_sds_printf	call site: 00090	/src/fluent-bit/src/flb_sds.c:439
0	0	None	0	61	flb_sds_printf	call site: 00086	/src/fluent-bit/src/flb_sds.c:430
0	0	None	0	2	flb_msgpack_to_gelf	call site: 00065	/src/fluent-bit/src/flb_pack_gelf.c:631
0	0	None	0	2	flb_msgpack_gelf_flatten	call site: 00106	/src/fluent-bit/src/flb_pack_gelf.c:357
0	0	None	0	0	flb_calloc	call site: 00061	/src/fluent-bit/include/fluent-bit/flb_mem.h:85
0	0	None	0	0	flb_calloc	call site: 00062	/src/fluent-bit/include/fluent-bit/flb_mem.h:90

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

21

Reachable functions

51

Percentage of reachable functions covered

58.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/msgpack_to_gelf_fuzzer.c	1
src/flb_sds.c	9
include/fluent-bit/flb_mem.h	5
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_pack_gelf.c	6
include/fluent-bit/flb_sds.h	3
include/fluent-bit/flb_utf8.h	2

Fuzzer: flb-it-fuzz-strp_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	7.24%
greenyellow	[30:49]	2	2.89%
lawngreen	50+	62	89.8%
All colors	69	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:71
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_fuzz_get_probability	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:59
0	0	None	0	0	_conv_num64	call site: 00041	/src/fluent-bit/src/flb_strptime.c:697
0	0	None	0	0	_conv_num64	call site: 00041	/src/fluent-bit/src/flb_strptime.c:716

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

7

Reachable functions

18

Percentage of reachable functions covered

61.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/strp_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	3
src/flb_strptime.c	6

Fuzzer: flb-it-fuzz-utils_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	23.6%
gold	[1:9]	18	4.77%
yellow	[10:29]	21	5.57%
greenyellow	[30:49]	14	3.71%
lawngreen	50+	235	62.3%
All colors	377	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00021	/src/fluent-bit/src/flb_log.c:647
2	8	2 : View List ['flb_hash_table_entry_free', 'time']	2	8	flb_hash_table_get	call site: 00249	/src/fluent-bit/src/flb_hash_table.c:396
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00011	/src/fluent-bit/include/fluent-bit/flb_log.h:105
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_init	call site: 00333	/src/fluent-bit/src/flb_hash.c:66
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_finalize	call site: 00342	/src/fluent-bit/src/flb_hash.c:99
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_update	call site: 00337	/src/fluent-bit/src/flb_hash.c:128
2	2	1 : View List ['EVP_sha256']	2	2	flb_crypto_get_digest_algorithm_instance_by_id	call site: 00327	/src/fluent-bit/src/flb_hash.c:25
2	2	1 : View List ['EVP_md5']	2	2	flb_crypto_get_digest_algorithm_instance_by_id	call site: 00328	/src/fluent-bit/src/flb_hash.c:28
0	130	5 : View List ['flb_log_print', 'flb_sds_len.122', 'flb_log_check.123', 'flb_sds_avail', 'flb_sds_increase']	0	130	flb_sds_printf	call site: 00194	/src/fluent-bit/src/flb_sds.c:437
0	0	None	18	34	flb_utils_proxy_url_split	call site: 00104	/src/fluent-bit/src/flb_utils.c:1029
0	0	None	16	87	flb_utils_url_split	call site: 00073	/src/fluent-bit/src/flb_utils.c:926
0	0	None	10	10	flb_utils_size_to_bytes	call site: 00129	/src/fluent-bit/src/flb_utils.c:408

Runtime coverage analysis

Covered functions

293

Functions that are reachable but not covered

43

Reachable functions

126

Percentage of reachable functions covered

65.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/utils_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_utils.c	14
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
include/fluent-bit/flb_utf8.h	2
include/fluent-bit/flb_str.h	2
src/flb_uri.c	5
src/flb_sds.c	8
include/fluent-bit/flb_uri.h	1
include/fluent-bit/flb_sds.h	3
src/flb_hash_table.c	14
src/flb_gzip.c	5
src/flb_hash.c	5
src/flb_regex.c	7
src/flb_slist.c	5

Fuzzer: flb-it-fuzz-pack_json_state_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	64.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	23	35.3%
All colors	65	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
61	65	3 : View List ['flb_errno_print', 'flb_realloc', '__errno_location']	61	177	pack_string_token	call site: 00037	/src/fluent-bit/src/flb_pack.c:125
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00044	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	122	165	flb_unescape_string_utf8	call site: 00042	/src/fluent-bit/src/flb_unescape.c:176
0	0	None	122	122	flb_unescape_string_utf8	call site: 00053	/src/fluent-bit/src/flb_unescape.c:196
0	0	None	61	67	flb_pack_state_init	call site: 00002	/src/fluent-bit/src/flb_pack.c:312
0	0	None	61	65	flb_json_tokenise	call site: 00033	/src/fluent-bit/src/flb_pack.c:72
0	0	None	2	8	u8_read_escape_sequence	call site: 00046	/src/fluent-bit/src/flb_unescape.c:98
0	0	None	2	8	u8_read_escape_sequence	call site: 00048	/src/fluent-bit/src/flb_unescape.c:106
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:71
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_fuzz_get_probability	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:59
0	0	None	0	0	flb_pack_state_init	call site: 00028	/src/fluent-bit/src/flb_pack.c:322

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

24

Reachable functions

41

Percentage of reachable functions covered

41.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/pack_json_state_fuzzer.c	1
src/flb_pack.c	7
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_unescape.c	5

Fuzzer: flb-it-fuzz-record_ac_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	228	44.6%
gold	[1:9]	30	5.87%
yellow	[10:29]	10	1.95%
greenyellow	[30:49]	9	1.76%
lawngreen	50+	234	45.7%
All colors	511	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
339	339	3 : View List ['flb_env_var_translate', 'flb_env_create', 'flb_env_destroy']	341	1157	flb_ra_create	call site: 00076	/src/fluent-bit/src/flb_record_accessor.c:283
90	90	8 : View List ['flb_ra_realloc', 'fread', 'yy_fatal_error', 'ferror', 'clearerr', '__errno_location', 'flb_ra_restart', 'getc']	90	90	yy_get_next_buffer	call site: 00292	/src/fluent-bit/build/src/record_accessor/ra_lex.c:1239
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00021	/src/fluent-bit/src/flb_log.c:647
2	217	5 : View List ['flb_msgpack_to_json', 'flb_errno_print', 'flb_free.33', 'flb_realloc', '__errno_location']	2	217	flb_msgpack_to_json_str	call site: 00407	/src/fluent-bit/src/flb_pack.c:1133
2	65	3 : View List ['flb_errno_print', 'flb_realloc', '__errno_location']	2	177	pack_string_token	call site: 00040	/src/fluent-bit/src/flb_pack.c:125
2	2	1 : View List ['__errno_location']	2	2	flb_ra_lex_init	call site: 00244	/src/fluent-bit/build/src/record_accessor/ra_lex.c:2063
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00011	/src/fluent-bit/include/fluent-bit/flb_log.h:105
0	5	1 : View List ['flb_sds_destroy']	0	23	flb_ra_create	call site: 00191	/src/fluent-bit/src/flb_record_accessor.c:333
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00047	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	19	184	flb_ra_lex	call site: 00288	/src/fluent-bit/build/src/record_accessor/ra_lex.c:964
0	0	None	19	182	flb_ra_lex	call site: 00288	/src/fluent-bit/build/src/record_accessor/ra_lex.c:1122
0	0	None	19	182	flb_ra_lex	call site: 00291	/src/fluent-bit/build/src/record_accessor/ra_lex.c:1158

Runtime coverage analysis

Covered functions

154

Functions that are reachable but not covered

70

Reachable functions

165

Percentage of reachable functions covered

57.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/record_ac_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_pack.c	13
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_unescape.c	5
src/flb_sds.c	8
src/flb_record_accessor.c	14
src/flb_env.c	7
src/flb_hash_table.c	11
include/fluent-bit/flb_str.h	2
include/fluent-bit/flb_sds.h	4
src/record_accessor/flb_ra_parser.c	12
build/src/record_accessor/ra_lex.c	23
build/src/record_accessor/ra_parser.c	4
build/src/record_accessor/ra.l	1
build/src/record_accessor/ra.y	1
src/flb_ra_key.c	5
src/flb_utils.c	2
include/fluent-bit/flb_utf8.h	2
src/flb_regex.c	1

Fuzzer: flb-it-fuzz-msgpack_parse_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	24.7%
gold	[1:9]	16	16.4%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	57	58.7%
All colors	97	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00019	/src/fluent-bit/src/flb_log.c:647
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00009	/src/fluent-bit/include/fluent-bit/flb_log.h:105
0	0	None	2	66	flb_msgpack_raw_to_json_sds	call site: 00086	/src/fluent-bit/src/flb_pack.c:775
0	0	None	0	6	msgpack2json	call site: 00043	/src/fluent-bit/src/flb_pack.c:592
0	0	None	0	0	flb_malloc	call site: 00005	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_log_construct	call site: 00015	/src/fluent-bit/src/flb_log.c:557
0	0	None	0	0	flb_log_construct	call site: 00017	/src/fluent-bit/src/flb_log.c:582
0	0	None	0	0	flb_log_construct	call site: 00018	/src/fluent-bit/src/flb_log.c:594
0	0	None	0	0	flb_log_print	call site: 00012	/src/fluent-bit/src/flb_log.c:642
0	0	None	0	0	flb_msgpack_to_json	call site: 00034	/src/fluent-bit/src/flb_pack.c:728
0	0	None	0	0	flb_sds_increase	call site: 00088	/src/fluent-bit/src/flb_sds.c:108
0	0	None	0	0	flb_utils_write_str	call site: 00049	/src/fluent-bit/src/flb_utils.c:703

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

18

Reachable functions

42

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/msgpack_parse_fuzzer.c	1
src/flb_pack.c	5
src/flb_sds.c	4
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_utils.c	2
include/fluent-bit/flb_utf8.h	2
include/fluent-bit/flb_sds.h	2

Fuzzer: flb-it-fuzz-flb_json_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	77	39.0%
gold	[1:9]	4	2.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	116	58.8%
All colors	197	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00019	/src/fluent-bit/src/flb_log.c:647
7	7	2 : View List ['flb_mp_count', 'msgpack_pack_array']	7	779	flb_pack_msgpack_to_json_format	call site: 00136	/src/fluent-bit/src/flb_pack.c:926
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00009	/src/fluent-bit/include/fluent-bit/flb_log.h:105
0	186	1 : View List ['flb_msgpack_raw_to_json_sds']	0	193	flb_pack_msgpack_to_json_format	call site: 00189	/src/fluent-bit/src/flb_pack.c:1084
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00045	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	61	290	flb_msgpack_raw_to_json_sds	call site: 00165	/src/fluent-bit/src/flb_pack.c:757
0	0	None	61	217	flb_msgpack_to_json_str	call site: 00066	/src/fluent-bit/src/flb_pack.c:1126
0	0	None	61	67	flb_pack_state_init	call site: 00004	/src/fluent-bit/src/flb_pack.c:312
0	0	None	61	66	flb_msgpack_raw_to_json_sds	call site: 00170	/src/fluent-bit/src/flb_pack.c:775
0	0	None	61	65	flb_json_tokenise	call site: 00034	/src/fluent-bit/src/flb_pack.c:72
0	0	None	61	61	flb_msgpack_to_json_str	call site: 00121	/src/fluent-bit/src/flb_pack.c:1137
0	0	None	7	779	flb_pack_msgpack_to_json_format	call site: 00133	/src/fluent-bit/src/flb_pack.c:906

Runtime coverage analysis

Covered functions

105

Functions that are reachable but not covered

28

Reachable functions

76

Percentage of reachable functions covered

63.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/flb_json_fuzzer.c	1
src/flb_pack.c	16
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	6
src/flb_unescape.c	5
src/flb_utils.c	2
include/fluent-bit/flb_utf8.h	2
src/flb_sds.c	7
src/flb_mp.c	2
include/fluent-bit/flb_sds.h	4

Fuzzer: flb-it-fuzz-config_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1397	67.1%
gold	[1:9]	25	1.20%
yellow	[10:29]	19	0.91%
greenyellow	[30:49]	6	0.28%
lawngreen	50+	632	30.3%
All colors	2079	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
541	541	1 : View List ['flb_parser_ltsv_do']	541	541	flb_parser_do	call site: 01223	/src/fluent-bit/src/flb_parser.c:965
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00476	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
79	79	1 : View List ['flb_slist_add']	79	79	flb_slist_split_tokens	call site: 01005	/src/fluent-bit/src/flb_slist.c:204
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00022	/src/fluent-bit/src/flb_log.c:647
26	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	26	26	flb_parser_create	call site: 00346	/src/fluent-bit/src/flb_parser.c:316
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00175	/src/fluent-bit/src/flb_config.c:369
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00214	/src/fluent-bit/src/flb_config.c:448
16	16	1 : View List ['strncasecmp']	16	16	get_section_type	call site: 00043	/src/fluent-bit/src/config_format/flb_config_format.c:90
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00272	/src/fluent-bit/src/flb_config.c:495
6	6	1 : View List ['strcasecmp']	6	6	flb_ml_type_lookup	call site: 00978	/src/fluent-bit/src/multiline/flb_ml.c:85
5	5	2 : View List ['msgpack_sbuffer_destroy.1529', 'merge_record_and_extra_keys']	5	5	flb_parser_decoder_do	call site: 01221	/src/fluent-bit/src/flb_parser_decoder.c:537
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00194	/src/fluent-bit/src/flb_config.c:406

Runtime coverage analysis

Covered functions

469

Functions that are reachable but not covered

305

Reachable functions

480

Percentage of reachable functions covered

36.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_fuzzer.c	1
src/flb_config.c	8
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	2
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	8
src/config_format/flb_config_format.c	14
src/flb_sds.c	10
src/flb_kv.c	6
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	7
src/flb_hash_table.c	12
src/flb_plugin.c	12
src/flb_scheduler.c	6
src/flb_parser.c	18
src/flb_regex.c	8
src/flb_parser_decoder.c	9
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	11
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_utils.c	5
src/config_format/flb_cf_fluentbit.c	10
include/fluent-bit/flb_sds.h	5
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
src/flb_pack.c	9
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_plugin_proxy.c	15
src/flb_api.c	2
src/flb_output.c	8
src/flb_input.c	17
src/proxy/go/go.c	10
include/fluent-bit/flb_output.h	2
src/flb_coro.c	1
src/flb_output_thread.c	2
src/flb_input_log.c	2
src/flb_mp.c	2
src/flb_input_chunk.c	35
src/flb_ring_buffer.c	3
src/flb_task.c	5
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	14
include/fluent-bit/flb_input.h	1
src/flb_input_thread.c	2
src/flb_lib.c	2
src/flb_engine.c	3
src/flb_router.c	3
src/flb_uri.c	1
src/tls/flb_tls.c	1
src/flb_config_map.c	2
src/flb_event.c	1
src/flb_metrics.c	3
src/flb_storage.c	2
src/flb_filter.c	5
include/fluent-bit/flb_output_plugin.h	1
src/flb_thread_pool.c	1
src/flb_callback.c	1
src/flb_custom.c	3
src/flb_metrics_exporter.c	1
src/http_server/flb_hs.c	1
src/http_server/api/v1/health.c	1
src/http_server/flb_hs_endpoints.c	1
plugins/in_storage_backlog/sb.c	7
plugins/in_emitter/emitter.c	4

Fuzzer: flb-it-fuzz-parse_logfmt_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	388	44.1%
gold	[1:9]	204	23.2%
yellow	[10:29]	14	1.59%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	273	31.0%
All colors	879	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
541	541	1 : View List ['flb_parser_ltsv_do']	541	541	flb_parser_do	call site: 00842	/src/fluent-bit/src/flb_parser.c:965
514	514	1 : View List ['flb_parser_json_do']	514	514	flb_parser_do	call site: 00648	/src/fluent-bit/src/flb_parser.c:961
336	336	1 : View List ['flb_parser_regex_do']	336	336	flb_parser_do	call site: 00647	/src/fluent-bit/src/flb_parser.c:957
290	290	2 : View List ['msgpack_sbuffer_destroy.1625', 'flb_parser_decoder_do']	290	290	flb_parser_logfmt_do	call site: 00875	/src/fluent-bit/src/flb_parser_logfmt.c:314
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:647
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00171	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:448
15	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	15	26	flb_parser_create	call site: 00342	/src/fluent-bit/src/flb_parser.c:316
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00268	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00107	/src/fluent-bit/src/flb_config.c:280

Runtime coverage analysis

Covered functions

277

Functions that are reachable but not covered

118

Reachable functions

202

Percentage of reachable functions covered

41.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_logfmt_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-engine_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	937	93.3%
gold	[1:9]	52	5.17%
yellow	[10:29]	10	0.99%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	4	0.39%
All colors	1004	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5575	5575	2 : View List ['flb_hs_create', 'flb_hs_start']	9717	13491	flb_engine_start	call site: 00000	/src/fluent-bit/src/flb_engine.c:794
1412	1412	3 : View List ['flb_output_thread_pool_start', 'flb_output_instance_destroy', 'flb_output_thread_pool_create']	1412	1412	flb_output_enable_multi_threading	call site: 00000	/src/fluent-bit/src/flb_output.c:945
1265	1265	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	3245	3493	flb_input_instance_init	call site: 00000	/src/fluent-bit/src/flb_input.c:1125
816	877	4 : View List ['flb_config_exit', 'flb_log_check.5561', 'flb_destroy', 'flb_log_print']	816	877	flb_create	call site: 00000	/src/fluent-bit/src/flb_lib.c:197
798	798	2 : View List ['flb_engine_dispatch_retry', 'flb_sched_request_destroy']	798	798	flb_sched_event_handler	call site: 00000	/src/fluent-bit/src/flb_scheduler.c:400
178	239	3 : View List ['flb_config_exit', 'flb_log_check.295', 'flb_log_print']	178	239	flb_config_init	call site: 00000	/src/fluent-bit/src/flb_config.c:333
167	293	12 : View List ['flb_log_print', 'cio_chunk_down', 'sb_allocate_backlogs', 'sb_append_chunk_to_segregated_backlogs', 'cio_chunk_lock', 'cio_chunk_close', 'flb_input_name', 'flb_log_check_level.9474', 'cio_chunk_get_content_size', 'cio_error_get', 'cio_chunk_is_up', 'cio_chunk_up_force']	167	293	sb_segregate_chunks	call site: 00000	/src/fluent-bit/plugins/in_storage_backlog/sb.c:338
146	207	4 : View List ['flb_log_print', 'flb_free.2972', 'parse_string_map_to_list', 'flb_log_check.2970']	146	207	translate_default_value	call site: 00000	/src/fluent-bit/src/flb_config_map.c:167
143	143	1 : View List ['flb_tls_create']	8008	9941	flb_input_instance_init	call site: 00000	/src/fluent-bit/src/flb_input.c:1019
126	126	4 : View List ['flb_errno_print', 'flb_task_queue_create', 'flb_free.2701', '__errno_location']	126	130	flb_output_new	call site: 00092	/src/fluent-bit/src/flb_output.c:679
114	114	2 : View List ['flb_task_queue_destroy', 'flb_net_host_set']	240	244	flb_output_new	call site: 00065	/src/fluent-bit/src/flb_output.c:666
92	275	3 : View List ['flb_log_print', 'flb_log_check.4142', 'flb_router_match']	92	340	flb_router_io_set	call site: 00000	/src/fluent-bit/src/flb_router.c:181

Runtime coverage analysis

Covered functions

482

Functions that are reachable but not covered

238

Reachable functions

283

Percentage of reachable functions covered

15.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/engine_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_lib.c	7
src/flb_output.c	9
src/flb_log.c	8
include/fluent-bit/flb_log.h	2
src/flb_worker.c	4
src/flb_pipe.c	2
src/flb_time.c	8
src/flb_callback.c	2
src/flb_hash_table.c	11
src/flb_task.c	6
src/flb_network.c	1
src/flb_sds.c	7
src/flb_uri.c	2
include/fluent-bit/flb_str.h	2
src/flb_kv.c	4
src/flb_filter.c	7
src/flb_input.c	20
src/flb_ring_buffer.c	4
src/flb_config.c	2
include/fluent-bit/flb_sds.h	5
src/flb_input_chunk.c	38
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	14
include/fluent-bit/flb_input.h	1
src/flb_input_thread.c	2
src/flb_engine.c	3
src/flb_router.c	3
src/tls/flb_tls.c	1
src/flb_config_map.c	2
src/flb_slist.c	1
src/flb_scheduler.c	6
src/flb_event.c	1
src/flb_metrics.c	3
src/flb_storage.c	2
src/flb_regex.c	1
src/flb_output_thread.c	1
include/fluent-bit/flb_output_plugin.h	1
src/flb_thread_pool.c	1
src/flb_custom.c	3
src/flb_metrics_exporter.c	1
src/http_server/flb_hs.c	1
src/http_server/api/v1/health.c	1
src/http_server/flb_hs_endpoints.c	1
src/flb_env.c	1
src/flb_plugin.c	2
src/flb_parser.c	2
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	1
src/multiline/flb_ml_parser.c	2
src/multiline/flb_ml_rule.c	2
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	1
src/config_format/flb_config_format.c	5
plugins/in_storage_backlog/sb.c	7
src/flb_pack.c	1
plugins/in_emitter/emitter.c	4
src/flb_input_log.c	2
src/flb_mp.c	2

Fuzzer: flb-it-fuzz-signv4_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	386	32.2%
gold	[1:9]	292	24.3%
yellow	[10:29]	36	3.00%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	482	40.2%
All colors	1197	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
99	219	6 : View List ['flb_log_print', 'flb_utils_proxy_url_split', '__errno_location', 'flb_log_check.4032', 'atoi', 'flb_errno_print']	99	221	flb_upstream_create	call site: 00669	/src/fluent-bit/src/flb_upstream.c:257
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00025	/src/fluent-bit/src/flb_log.c:647
22	144	3 : View List ['flb_log_print', 'flb_log_check.6204', 'proxy_parse']	24	237	flb_http_client	call site: 00733	/src/fluent-bit/src/flb_http_client.c:759
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00181	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00048	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00220	/src/fluent-bit/src/flb_config.c:448
15	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	15	26	flb_parser_create	call site: 00352	/src/fluent-bit/src/flb_parser.c:316
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00278	/src/fluent-bit/src/flb_config.c:495
7	16	2 : View List ['flb_kv_item_destroy', 'flb_sds_casecmp']	7	102	flb_http_add_header	call site: 00763	/src/fluent-bit/src/flb_http_client.c:899
6	6	1 : View List ['flb_tls_destroy']	6	6	flb_aws_provider_destroy	call site: 00657	/src/fluent-bit/src/aws/flb_aws_credentials.c:768
4	113	4 : View List ['strcmp', 'flb_slist_create', 'flb_slist_destroy', 'flb_slist_split_string']	4	113	flb_upstream_needs_proxy	call site: 00669	/src/fluent-bit/src/flb_upstream.c:316
4	4	1 : View List ['strcasecmp']	39	537	flb_parser_create	call site: 00303	/src/fluent-bit/src/flb_parser.c:195

Runtime coverage analysis

Covered functions

325

Functions that are reachable but not covered

102

Reachable functions

241

Percentage of reachable functions covered

57.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/signv4_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/aws/flb_aws_credentials.c	3
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/flb_config.c	2
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	4
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/tls/flb_tls.c	2
src/flb_upstream.c	8
include/fluent-bit/flb_stream.h	6
src/flb_network.c	1
src/flb_utils.c	5
src/flb_http_client.c	6
include/fluent-bit/flb_sds.h	5
src/flb_signv4.c	15
src/flb_hash.c	7
src/flb_hmac.c	7
src/flb_connection.c	1

Fuzzer: flb-it-fuzz-aws_util_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	201	26.2%
gold	[1:9]	213	27.8%
yellow	[10:29]	25	3.26%
greenyellow	[30:49]	9	1.17%
lawngreen	50+	318	41.5%
All colors	766	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:647
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00176	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00043	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00215	/src/fluent-bit/src/flb_config.c:448
15	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	15	26	flb_parser_create	call site: 00347	/src/fluent-bit/src/flb_parser.c:316
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00273	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['strcasecmp']	39	537	flb_parser_create	call site: 00298	/src/fluent-bit/src/flb_parser.c:195
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00195	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00112	/src/fluent-bit/src/flb_config.c:280
2	61	3 : View List ['flb_errno_print', 'flb_malloc.1250', '__errno_location']	31	112	flb_parser_create	call site: 00339	/src/fluent-bit/src/flb_parser.c:248
2	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_free.2205']	2	61	flb_kernel_info	call site: 00093	/src/fluent-bit/src/flb_kernel.c:137
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00014	/src/fluent-bit/include/fluent-bit/flb_log.h:105

Runtime coverage analysis

Covered functions

276

Functions that are reachable but not covered

73

Reachable functions

164

Percentage of reachable functions covered

55.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/aws_util_fuzzer.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_config.c	2
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/aws/flb_aws_util.c	3
include/fluent-bit/flb_sds.h	3
src/aws/flb_aws_credentials_sts.c	2
src/flb_random.c	1

Fuzzer: flb-it-fuzz-config_random_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	449	43.0%
gold	[1:9]	39	3.73%
yellow	[10:29]	23	2.20%
greenyellow	[30:49]	16	1.53%
lawngreen	50+	517	49.5%
All colors	1044	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00474	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00022	/src/fluent-bit/src/flb_log.c:647
61	61	1 : View List ['flb_utils_error']	61	1295	flb_parser_conf_file	call site: 00650	/src/fluent-bit/src/flb_parser.c:887
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00174	/src/fluent-bit/src/flb_config.c:369
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00213	/src/fluent-bit/src/flb_config.c:448
14	2028	23 : View List ['read_config', '__ctype_b_loc', 'config_error', '__errno_location', 'fgets', 'flb_cf_section_property_add', 'flb_malloc.1003', 'char_search', 'flb_errno_print', 'flb_sds_len.990', 'config_warn', 'strncasecmp', 'flb_sds_create', 'flb_sds_create_len', 'flb_cf_meta_property_add', 'strlen', 'check_indent', 'flb_cf_section_create', 'feof', 'strchr', 'read_glob', 'mk_list_add.984', 'flb_cf_group_create']	18	2047	read_config	call site: 00693	/src/fluent-bit/src/config_format/flb_cf_fluentbit.c:546
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00271	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00193	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00110	/src/fluent-bit/src/flb_config.c:280
4	4	1 : View List ['strncmp']	4	4	hash_get_entry	call site: 00136	/src/fluent-bit/src/flb_hash_table.c:213
2	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_free.2205']	2	61	flb_kernel_info	call site: 00091	/src/fluent-bit/src/flb_kernel.c:137
2	2	1 : View List ['stat']	26	2362	read_config	call site: 00671	/src/fluent-bit/src/config_format/flb_cf_fluentbit.c:441

Runtime coverage analysis

Covered functions

499

Functions that are reachable but not covered

77

Reachable functions

209

Percentage of reachable functions covered

63.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_random_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	14
src/flb_sds.c	10
src/flb_kv.c	3
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	7
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	12
src/flb_regex.c	5
src/flb_parser_decoder.c	3
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	10
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_utils.c	5
src/config_format/flb_cf_fluentbit.c	10
include/fluent-bit/flb_sds.h	5

Fuzzer: flb-it-fuzz-parser_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	413	44.9%
gold	[1:9]	4	0.43%
yellow	[10:29]	6	0.65%
greenyellow	[30:49]	4	0.43%
lawngreen	50+	491	53.4%
All colors	918	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00472	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:647
61	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_free.2205']	61	61	flb_kernel_info	call site: 00088	/src/fluent-bit/src/flb_kernel.c:137
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00171	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:448
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00268	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00107	/src/fluent-bit/src/flb_config.c:280
4	4	2 : View List ['ntohl', 'ntohs']	4	294	flb_parser_regex_do	call site: 00689	/src/fluent-bit/src/flb_parser_regex.c:188
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00008	/src/fluent-bit/include/fluent-bit/flb_log.h:105
0	239	3 : View List ['flb_config_exit', 'flb_log_check.295', 'flb_log_print']	0	239	flb_config_init	call site: 00482	/src/fluent-bit/src/flb_config.c:333

Runtime coverage analysis

Covered functions

390

Functions that are reachable but not covered

76

Reachable functions

205

Percentage of reachable functions covered

62.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parser_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_utils.c	1
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-filter_stdout_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2726	77.0%
gold	[1:9]	8	0.22%
yellow	[10:29]	2	0.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	803	22.6%
All colors	3539	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
5575	5575	2 : View List ['flb_hs_create', 'flb_hs_start']	5813	13491	flb_engine_start	call site: 02924	/src/fluent-bit/src/flb_engine.c:794
1324	1959	4 : View List ['flb_chunk_trace_context_hit_limit', 'flb_chunk_trace_input', 'flb_chunk_trace_new', 'flb_chunk_trace_context_destroy']	1326	1961	flb_chunk_trace_do_input	call site: 01665	/src/fluent-bit/src/flb_chunk_trace.c:382
1265	1265	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	1265	3493	flb_input_instance_init	call site: 02329	/src/fluent-bit/src/flb_input.c:1125
1189	1189	1 : View List ['flb_chunk_trace_pre_output']	1189	1278	input_chunk_append_raw	call site: 01781	/src/fluent-bit/src/flb_input_chunk.c:1817
798	798	2 : View List ['flb_engine_dispatch_retry', 'flb_sched_request_destroy']	798	798	flb_sched_event_handler	call site: 02483	/src/fluent-bit/src/flb_scheduler.c:400
705	1344	2 : View List ['flb_output_task_singleplex_flush_next', 'flb_task_users_dec']	705	1344	flb_output_task_flush	call site: 02522	/src/fluent-bit/src/flb_output.c:311
705	705	1 : View List ['flb_output_task_singleplex_flush_next']	1026	1792	handle_output_event	call site: 02785	/src/fluent-bit/src/flb_engine.c:271
644	644	1 : View List ['memrb_input_chunk_release_space']	1835	7285	input_chunk_append_raw	call site: 01509	/src/fluent-bit/src/flb_input_chunk.c:1575
306	306	5 : View List ['flb_task_retry_destroy', 'flb_sched_request_create', 'cmt_counter_inc', 'flb_task_users_release.3315', 'flb_task_retry_create']	314	856	handle_output_event	call site: 02785	/src/fluent-bit/src/flb_engine.c:278
259	264	4 : View List ['write', 'flb_pack_msgpack_to_json_format', 'flb_sds_destroy', 'flb_sds_len.12022']	263	268	cb_stdout_flush	call site: 00000	/src/fluent-bit/plugins/out_stdout/stdout.c:190
250	631	13 : View List ['flb_log_print', 'flb_kv_item_create', 'flb_log_check.2656', 'flb_utils_time_to_seconds', 'strcasecmp', 'flb_regex_create', 'flb_log_get_level_str', 'atoi', 'flb_utils_bool', 'flb_utils_size_to_bytes', 'flb_sds_destroy', 'prop_key_check.2706', 'strncasecmp']	250	631	flb_output_set_property	call site: 01995	/src/fluent-bit/src/flb_output.c:735
242	418	11 : View List ['flb_log_print', 'flb_kv_item_create', 'flb_log_check.2300', 'strcasecmp', 'flb_log_get_level_str', 'atoi', 'flb_utils_bool', 'flb_utils_size_to_bytes', 'prop_key_check.2353', 'flb_sds_destroy', 'strncasecmp']	242	418	flb_input_set_property	call site: 01907	/src/fluent-bit/src/flb_input.c:471

Runtime coverage analysis

Covered functions

808

Functions that are reachable but not covered

557

Reachable functions

924

Percentage of reachable functions covered

39.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/filter_stdout_fuzzer.c	1
src/flb_lib.c	14
include/fluent-bit/flb_mem.h	5
src/flb_config.c	7
src/flb_log.c	9
include/fluent-bit/flb_log.h	2
src/flb_worker.c	9
src/flb_pipe.c	4
src/flb_time.c	9
src/config_format/flb_config_format.c	14
src/flb_sds.c	10
src/flb_kv.c	6
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	7
src/flb_hash_table.c	12
src/flb_plugin.c	12
src/flb_scheduler.c	23
src/flb_parser.c	12
src/flb_regex.c	5
src/flb_parser_decoder.c	3
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	10
include/fluent-bit/flb_bucket_queue.h	6
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_engine.c	15
src/flb_input.c	36
include/fluent-bit/flb_input.h	2
src/flb_input_thread.c	16
src/flb_router.c	6
src/flb_uri.c	2
src/tls/flb_tls.c	5
src/flb_config_map.c	9
src/flb_task.c	16
src/flb_input_chunk.c	39
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	17
src/flb_event.c	3
src/flb_metrics.c	14
src/flb_storage.c	14
src/flb_ring_buffer.c	6
src/flb_filter.c	6
src/flb_output.c	25
src/flb_output_thread.c	14
include/fluent-bit/flb_output_plugin.h	1
include/fluent-bit/flb_sds.h	5
src/flb_thread_pool.c	7
src/flb_callback.c	2
src/flb_custom.c	5
src/flb_metrics_exporter.c	8
src/http_server/flb_hs.c	8
src/http_server/api/v1/health.c	10
src/http_server/flb_hs_endpoints.c	3
src/flb_utils.c	11
src/config_format/flb_cf_fluentbit.c	10
src/flb_plugin_proxy.c	16
src/flb_api.c	2
src/proxy/go/go.c	11
include/fluent-bit/flb_output.h	4
src/flb_coro.c	4
src/flb_input_log.c	2
src/flb_mp.c	2
plugins/in_storage_backlog/sb.c	14
src/flb_pack.c	16
plugins/in_emitter/emitter.c	4
src/flb_network.c	16
src/tls/openssl.c	4
src/flb_upstream.c	14
src/flb_downstream.c	7
include/fluent-bit/flb_env.h	1
include/fluent-bit/flb_storage.h	1
include/fluent-bit/flb_stream.h	7
include/fluent-bit/flb_upstream.h	1
src/flb_connection.c	3
include/fluent-bit/flb_downstream.h	1
include/fluent-bit/flb_event_loop.h	2
src/flb_engine_dispatch.c	4
src/flb_random.c	1
include/fluent-bit/flb_task.h	3
include/fluent-bit/flb_time.h	1
src/flb_sosreport.c	8
include/fluent-bit/flb_utf8.h	2
src/http_server/api/v1/register.c	1
src/http_server/api/v1/uptime.c	3
src/http_server/flb_hs_utils.c	1
src/http_server/api/v1/metrics.c	12
src/http_server/api/v1/plugins.c	2
src/http_server/api/v1/trace.c	10
src/flb_unescape.c	5
src/http_server/api/v1/storage.c	6
src/http_server/api/v2/register.c	1
src/http_server/api/v2/metrics.c	8
include/fluent-bit/flb_router.h	1
tests/internal/fuzzers/flb_fuzz_header.h	1

Fuzzer: flb-it-fuzz-http_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	782	64.7%
gold	[1:9]	6	0.49%
yellow	[10:29]	12	0.99%
greenyellow	[30:49]	4	0.33%
lawngreen	50+	403	33.3%
All colors	1207	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
882	882	1 : View List ['net_io_write']	889	889	flb_io_net_write	call site: 00890	/src/fluent-bit/src/flb_io.c:646
206	1671	9 : View List ['flb_log_print', 'check_connection', 'flb_upstream_conn_recycle', 'flb_io_net_write', 'flb_http_buffer_increase', 'process_data', 'flb_http_buffer_available', 'flb_log_check.6204', 'flb_io_net_read']	208	1732	flb_http_do	call site: 00850	/src/fluent-bit/src/flb_http_client.c:1225
122	122	1 : View List ['flb_http_proxy_auth']	122	1445	flb_http_client_proxy_connect	call site: 01055	/src/fluent-bit/src/flb_http_client.c:1357
99	219	6 : View List ['flb_log_print', 'flb_utils_proxy_url_split', '__errno_location', 'flb_log_check.4032', 'atoi', 'flb_errno_print']	99	221	flb_upstream_create	call site: 00651	/src/fluent-bit/src/flb_upstream.c:257
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00472	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
85	85	2 : View List ['flb_tls_net_write', 'flb_tls_net_write_async']	92	92	flb_io_net_write	call site: 00890	/src/fluent-bit/src/flb_io.c:645
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:647
26	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	26	26	flb_parser_create	call site: 00342	/src/fluent-bit/src/flb_parser.c:316
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00171	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:448
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00268	/src/fluent-bit/src/flb_config.c:495

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

164

Reachable functions

300

Percentage of reachable functions covered

45.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/http_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	3
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	8
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_upstream.c	10
include/fluent-bit/flb_stream.h	8
src/flb_network.c	35
src/flb_utils.c	2
src/flb_connection.c	10
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_http_client.c	30
include/fluent-bit/flb_sds.h	4
src/flb_base64.c	1
src/flb_io.c	7
src/flb_coro.c	1
src/flb_socket.c	1
src/flb_engine.c	1
src/tls/flb_tls.c	9

Fuzzer: flb-it-fuzz-multiline_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	645	57.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	2	0.17%
lawngreen	50+	478	42.4%
All colors	1126	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1099	1099	2 : View List ['flb_parser_ltsv_do', 'flb_parser_logfmt_do']	1099	1099	flb_parser_do	call site: 00780	/src/fluent-bit/src/flb_parser.c:961
302	302	8 : View List ['ntohl', 'flb_parser_decoder_do', 'flb_regex_parse', 'ntohs', 'msgpack_pack_map.1367', 'msgpack_packer_init.1372', 'msgpack_sbuffer_destroy.1364', 'msgpack_sbuffer_init.1373']	302	302	flb_parser_regex_do	call site: 00781	/src/fluent-bit/src/flb_parser_regex.c:133
290	290	3 : View List ['msgpack_unpacked_init.1413', 'flb_parser_decoder_do', 'msgpack_unpack_next']	294	605	flb_parser_json_do	call site: 00941	/src/fluent-bit/src/flb_parser_json.c:94
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00514	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
70	341	4 : View List ['package_content', 'get_key_id', 'msgpack_unpacked_destroy', 'flb_time_pop_from_msgpack']	70	341	process_append	call site: 00993	/src/fluent-bit/src/multiline/flb_ml.c:433
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:647
61	61	3 : View List ['flb_errno_print', 'flb_malloc.1250', '__errno_location']	112	112	flb_parser_create	call site: 00378	/src/fluent-bit/src/flb_parser.c:248
61	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_free.2205']	61	61	flb_kernel_info	call site: 00133	/src/fluent-bit/src/flb_kernel.c:137
26	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	26	26	flb_parser_create	call site: 00386	/src/fluent-bit/src/flb_parser.c:316
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00216	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00085	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00255	/src/fluent-bit/src/flb_config.c:448

Runtime coverage analysis

Covered functions

434

Functions that are reachable but not covered

250

Reachable functions

407

Percentage of reachable functions covered

38.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/multiline_fuzzer.c	3
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_pack.c	11
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	9
src/flb_unescape.c	7
src/flb_config.c	2
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	9
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	21
src/multiline/flb_ml_parser.c	9
src/multiline/flb_ml_rule.c	11
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/multiline/flb_ml_group.c	3
src/multiline/flb_ml_stream.c	10
include/fluent-bit/flb_time.h	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	5
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-parse_ltsv_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	636	72.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	243	27.6%
All colors	879	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
558	558	1 : View List ['flb_parser_logfmt_do']	558	558	flb_parser_do	call site: 00842	/src/fluent-bit/src/flb_parser.c:965
514	514	1 : View List ['flb_parser_json_do']	514	514	flb_parser_do	call site: 00648	/src/fluent-bit/src/flb_parser.c:961
336	336	1 : View List ['flb_parser_regex_do']	336	336	flb_parser_do	call site: 00647	/src/fluent-bit/src/flb_parser.c:957
290	290	2 : View List ['msgpack_sbuffer_destroy.1567', 'flb_parser_decoder_do']	290	290	flb_parser_ltsv_do	call site: 00862	/src/fluent-bit/src/flb_parser_ltsv.c:257
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00472	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
61	239	3 : View List ['flb_config_exit', 'flb_log_check.295', 'flb_log_print']	61	239	flb_config_init	call site: 00482	/src/fluent-bit/src/flb_config.c:333
61	89	3 : View List ['flb_log_print', 'flb_ml_parser_destroy', 'flb_log_check.6402']	61	89	flb_ml_parser_go	call site: 00453	/src/fluent-bit/src/multiline/flb_ml_parser_go.c:133
61	89	3 : View List ['flb_log_check.6366', 'flb_ml_parser_destroy', 'flb_log_print']	61	89	flb_ml_parser_java	call site: 00425	/src/fluent-bit/src/multiline/flb_ml_parser_java.c:136
61	89	3 : View List ['flb_log_print', 'flb_ml_parser_destroy', 'flb_log_check.6440']	61	89	flb_ml_parser_ruby	call site: 00460	/src/fluent-bit/src/multiline/flb_ml_parser_ruby.c:80
61	61	3 : View List ['flb_errno_print', 'flb_malloc.1250', '__errno_location']	112	112	flb_parser_create	call site: 00334	/src/fluent-bit/src/flb_parser.c:248
61	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_free.2205']	61	61	flb_kernel_info	call site: 00088	/src/fluent-bit/src/flb_kernel.c:137
26	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	26	26	flb_parser_create	call site: 00342	/src/fluent-bit/src/flb_parser.c:316

Runtime coverage analysis

Covered functions

263

Functions that are reachable but not covered

130

Reachable functions

202

Percentage of reachable functions covered

35.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_ltsv_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-parse_json_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	381	43.3%
gold	[1:9]	211	24.0%
yellow	[10:29]	11	1.25%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	275	31.3%
All colors	878	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1099	1099	2 : View List ['flb_parser_ltsv_do', 'flb_parser_logfmt_do']	1099	1099	flb_parser_do	call site: 00648	/src/fluent-bit/src/flb_parser.c:961
336	336	1 : View List ['flb_parser_regex_do']	336	336	flb_parser_do	call site: 00647	/src/fluent-bit/src/flb_parser.c:957
290	290	3 : View List ['msgpack_unpacked_init.1413', 'flb_parser_decoder_do', 'msgpack_unpack_next']	544	605	flb_parser_json_do	call site: 00844	/src/fluent-bit/src/flb_parser_json.c:94
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:647
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00171	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:448
15	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	15	26	flb_parser_create	call site: 00342	/src/fluent-bit/src/flb_parser.c:316
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00268	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['strcasecmp']	39	537	flb_parser_create	call site: 00293	/src/fluent-bit/src/flb_parser.c:195
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00107	/src/fluent-bit/src/flb_config.c:280

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

110

Reachable functions

202

Percentage of reachable functions covered

45.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_json_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	4
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	5
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-config_map_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	225	26.5%
gold	[1:9]	212	24.9%
yellow	[10:29]	38	4.47%
greenyellow	[30:49]	13	1.53%
lawngreen	50+	361	42.5%
All colors	849	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
76	81	2 : View List ['buf_append', 'flb_sds_destroy']	76	219	flb_env_var_translate	call site: 00699	/src/fluent-bit/src/flb_env.c:240
65	130	5 : View List ['flb_log_print', 'flb_sds_len.122', 'flb_log_check.123', 'flb_sds_avail', 'flb_sds_increase']	65	130	flb_sds_printf	call site: 00817	/src/fluent-bit/src/flb_sds.c:437
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00023	/src/fluent-bit/src/flb_log.c:647
65	65	1 : View List ['flb_sds_increase']	65	65	flb_sds_copy	call site: 00704	/src/fluent-bit/src/flb_sds.c:266
20	20	1 : View List ['flb_log_destroy']	64	224	flb_config_exit	call site: 00175	/src/fluent-bit/src/flb_config.c:369
20	20	1 : View List ['strncasecmp']	20	20	get_section_type	call site: 00042	/src/fluent-bit/src/config_format/flb_config_format.c:84
19	19	1 : View List ['flb_sched_destroy']	30	143	flb_config_exit	call site: 00214	/src/fluent-bit/src/flb_config.c:448
15	26	3 : View List ['flb_interim_parser_destroy', 'strlen', 'flb_parser_tzone_offset']	15	26	flb_parser_create	call site: 00346	/src/fluent-bit/src/flb_parser.c:316
11	11	1 : View List ['flb_bucket_queue_destroy']	11	75	flb_config_exit	call site: 00272	/src/fluent-bit/src/flb_config.c:495
4	4	1 : View List ['strcasecmp']	39	537	flb_parser_create	call site: 00297	/src/fluent-bit/src/flb_parser.c:195
4	4	1 : View List ['close']	34	194	flb_config_exit	call site: 00194	/src/fluent-bit/src/flb_config.c:406
4	4	1 : View List ['getpagesize']	8	1502	flb_config_init	call site: 00111	/src/fluent-bit/src/flb_config.c:280

Runtime coverage analysis

Covered functions

296

Functions that are reachable but not covered

71

Reachable functions

182

Percentage of reachable functions covered

60.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_map_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_config.c	2
src/flb_log.c	5
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	4
src/flb_kernel.c	1
include/fluent-bit/flb_str.h	3
src/flb_env.c	7
src/flb_hash_table.c	11
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
src/flb_slist.c	9
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_config_map.c	13
include/fluent-bit/flb_env.h	1
include/fluent-bit/flb_sds.h	4
src/flb_utils.c	3