High level conclusions

Fuzzers reach 30.98% of cyclomatic complexity.

Fuzzers reach 35.50% of all functions.

Fuzzer flb-it-fuzz-engine_fuzzer_OSSFUZZ is blocked:

The runtime code coverage of flb-it-fuzz-engine_fuzzer_OSSFUZZ covers 27.93% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1247 / 3512

Cyclomatic complexity statically reachable by fuzzers

9307 / 30034

Runtime code coverage of functions

992 / 3512

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: flb-it-fuzz-base64_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	flb_base64_encode	call site: 00001	/src/fluent-bit/src/flb_base64.c:95
0	0	None	0	0	flb_base64_encode	call site: 00001	/src/fluent-bit/src/flb_base64.c:103

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/base64_fuzzer.c	1
src/flb_base64.c	2

Fuzzer: flb-it-fuzz-ctrace_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

237

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/ctrace_fuzzer.c	1

Fuzzer: flb-it-fuzz-flb_json_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	81	38.7%
gold	[1:9]	4	1.91%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	124	59.3%
All colors	209	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00019	/src/fluent-bit/src/flb_log.c:651
7	7	2 : View List ['msgpack_pack_array', 'flb_mp_count']	7	831	flb_pack_msgpack_to_json_format	call site: 00147	/src/fluent-bit/src/flb_pack.c:962
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00009	/src/fluent-bit/include/fluent-bit/flb_log.h:106
0	211	1 : View List ['flb_msgpack_raw_to_json_sds']	0	218	flb_pack_msgpack_to_json_format	call site: 00201	/src/fluent-bit/src/flb_pack.c:1120
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00046	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	61	317	flb_msgpack_raw_to_json_sds	call site: 00176	/src/fluent-bit/src/flb_pack.c:792
0	0	None	61	242	flb_msgpack_to_json_str	call site: 00067	/src/fluent-bit/src/flb_pack.c:1162
0	0	None	61	66	flb_msgpack_raw_to_json_sds	call site: 00181	/src/fluent-bit/src/flb_pack.c:811
0	0	None	61	65	flb_json_tokenise	call site: 00035	/src/fluent-bit/src/flb_pack.c:72
0	0	None	61	61	flb_pack_state_init	call site: 00004	/src/fluent-bit/src/flb_pack.c:318
0	0	None	61	61	flb_msgpack_to_json_str	call site: 00131	/src/fluent-bit/src/flb_pack.c:1173
0	0	None	24	304	flb_utils_write_str	call site: 00092	/src/fluent-bit/src/flb_utils.c:839

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

29

Reachable functions

80

Percentage of reachable functions covered

63.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/flb_json_fuzzer.c	1
src/flb_pack.c	16
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	6
src/flb_unescape.c	5
src/flb_utils.c	1
include/fluent-bit/flb_simd.h	5
src/flb_utf8.c	2
src/flb_sds.c	7
src/flb_mp.c	2
include/fluent-bit/flb_sds.h	4

Fuzzer: flb-it-fuzz-flb_mp_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	1	25.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	25.0%
lawngreen	50+	2	50.0%
All colors	4	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	2	2	flb_mp_validate_log_chunk	call site: 00002	/src/fluent-bit/src/flb_mp.c:175
0	0	None	0	0	flb_mp_validate_log_chunk	call site: 00002	/src/fluent-bit/src/flb_mp.c:155

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

1

Reachable functions

4

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/flb_mp_fuzzer.c	1
src/flb_mp.c	2

Fuzzer: flb-it-fuzz-strp_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	2.46%
greenyellow	[30:49]	6	7.40%
lawngreen	50+	73	90.1%
All colors	81	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:71
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_fuzz_get_probability	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:59
0	0	None	0	0	_conv_num64	call site: 00053	/src/fluent-bit/src/flb_strptime.c:697
0	0	None	0	0	_conv_num64	call site: 00053	/src/fluent-bit/src/flb_strptime.c:716

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

7

Reachable functions

18

Percentage of reachable functions covered

61.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/strp_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	3
src/flb_strptime.c	6

Fuzzer: flb-it-fuzz-record_ac_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	240	44.7%
gold	[1:9]	31	5.78%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	1.11%
lawngreen	50+	259	48.3%
All colors	536	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
393	393	3 : View List ['flb_env_var_translate', 'flb_env_destroy', 'flb_env_create']	395	1089	flb_ra_create	call site: 00081	/src/fluent-bit/src/flb_record_accessor.c:291
90	90	8 : View List ['getc', 'flb_ra_restart', 'fread', '__errno_location', 'clearerr', 'ferror', 'flb_ra_realloc', 'yy_fatal_error']	90	90	yy_get_next_buffer	call site: 00303	/src/fluent-bit/build/src/record_accessor/ra_lex.c:1239
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00021	/src/fluent-bit/src/flb_log.c:651
2	242	5 : View List ['flb_realloc', '__errno_location', 'flb_msgpack_to_json', 'flb_errno_print', 'flb_free.45']	2	242	flb_msgpack_to_json_str	call site: 00421	/src/fluent-bit/src/flb_pack.c:1169
2	65	3 : View List ['flb_realloc', '__errno_location', 'flb_errno_print']	2	177	pack_string_token	call site: 00042	/src/fluent-bit/src/flb_pack.c:125
2	2	1 : View List ['__errno_location']	2	2	flb_ra_lex_init	call site: 00253	/src/fluent-bit/build/src/record_accessor/ra_lex.c:2063
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00011	/src/fluent-bit/include/fluent-bit/flb_log.h:106
0	5	1 : View List ['flb_sds_destroy']	0	23	flb_ra_create	call site: 00203	/src/fluent-bit/src/flb_record_accessor.c:336
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00048	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	24	304	flb_utils_write_str	call site: 00443	/src/fluent-bit/src/flb_utils.c:839
0	0	None	19	184	flb_ra_lex	call site: 00299	/src/fluent-bit/build/src/record_accessor/ra_lex.c:964
0	0	None	19	182	flb_ra_lex	call site: 00299	/src/fluent-bit/build/src/record_accessor/ra_lex.c:1122

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

74

Reachable functions

172

Percentage of reachable functions covered

56.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/record_ac_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_pack.c	13
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_unescape.c	5
src/flb_sds.c	8
src/flb_record_accessor.c	14
src/flb_env.c	7
src/flb_hash_table.c	13
include/fluent-bit/flb_str.h	2
include/fluent-bit/flb_sds.h	4
src/record_accessor/flb_ra_parser.c	12
build/src/record_accessor/ra_lex.c	23
build/src/record_accessor/ra_parser.c	4
build/src/record_accessor/ra.l	1
build/src/record_accessor/ra.y	1
src/flb_ra_key.c	5
src/flb_utils.c	1
include/fluent-bit/flb_simd.h	5
src/flb_utf8.c	2
src/flb_regex.c	1

Fuzzer: flb-it-fuzz-config_yaml_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	339	40.8%
gold	[1:9]	101	12.1%
yellow	[10:29]	18	2.17%
greenyellow	[30:49]	3	0.36%
lawngreen	50+	368	44.3%
All colors	829	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:651
2	2	1 : View List ['strlen']	2	73	flb_cf_group_create	call site: 00373	/src/fluent-bit/src/config_format/flb_config_format.c:550
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00014	/src/fluent-bit/include/fluent-bit/flb_log.h:106
2	2	2 : View List ['globfree', 'read_config.221']	2	2	read_glob	call site: 00202	/src/fluent-bit/src/config_format/flb_cf_yaml.c:503
0	132	5 : View List ['flb_log_check.133', 'flb_sds_increase', 'flb_sds_avail', 'flb_sds_len.134', 'flb_log_print']	0	132	flb_sds_printf	call site: 00081	/src/fluent-bit/src/flb_sds.c:365
0	112	1 : View List ['yaml_error_event_line']	0	112	consume_event	call site: 00195	/src/fluent-bit/src/config_format/flb_cf_yaml.c:921
0	112	1 : View List ['yaml_error_event_line']	0	112	consume_event	call site: 00561	/src/fluent-bit/src/config_format/flb_cf_yaml.c:1691
0	112	1 : View List ['yaml_error_event_line']	0	112	consume_event	call site: 00604	/src/fluent-bit/src/config_format/flb_cf_yaml.c:1777
0	112	1 : View List ['yaml_error_event_line']	0	112	consume_event	call site: 00662	/src/fluent-bit/src/config_format/flb_cf_yaml.c:1893
0	97	1 : View List ['state_push_key']	0	158	consume_event	call site: 00673	/src/fluent-bit/src/config_format/flb_cf_yaml.c:1920
0	80	3 : View List ['flb_log_check.215', 'state_pop', 'flb_log_print']	0	192	consume_event	call site: 00720	/src/fluent-bit/src/config_format/flb_cf_yaml.c:2061
0	65	1 : View List ['flb_sds_increase']	0	65	flb_sds_cat	call site: 00306	/src/fluent-bit/src/flb_sds.c:127

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

42

Reachable functions

125

Percentage of reachable functions covered

66.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_yaml_fuzzer.c	1
src/config_format/flb_cf_yaml.c	37
src/config_format/flb_config_format.c	14
include/fluent-bit/flb_mem.h	5
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_slist.c	4
src/flb_kv.c	3
src/flb_sds.c	10
include/fluent-bit/flb_sds.h	4

Fuzzer: flb-it-fuzz-utils_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	24.6%
gold	[1:9]	20	4.69%
yellow	[10:29]	21	4.92%
greenyellow	[30:49]	17	3.99%
lawngreen	50+	263	61.7%
All colors	426	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00021	/src/fluent-bit/src/flb_log.c:651
2	8	2 : View List ['flb_hash_table_entry_free', 'time']	2	8	flb_hash_table_get	call site: 00286	/src/fluent-bit/src/flb_hash_table.c:513
2	2	1 : View List ['strncasecmp']	2	8	flb_hash_table_del	call site: 00294	/src/fluent-bit/src/flb_hash_table.c:644
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00011	/src/fluent-bit/include/fluent-bit/flb_log.h:106
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_init	call site: 00379	/src/fluent-bit/src/flb_hash.c:66
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_finalize	call site: 00389	/src/fluent-bit/src/flb_hash.c:99
2	2	1 : View List ['ERR_get_error']	2	2	flb_hash_update	call site: 00384	/src/fluent-bit/src/flb_hash.c:128
2	2	1 : View List ['EVP_sha256']	2	2	flb_crypto_get_digest_algorithm_instance_by_id	call site: 00373	/src/fluent-bit/src/flb_hash.c:25
2	2	1 : View List ['EVP_md5']	2	2	flb_crypto_get_digest_algorithm_instance_by_id	call site: 00374	/src/fluent-bit/src/flb_hash.c:28
2	2	1 : View List ['strncasecmp']	2	2	hash_get_entry	call site: 00263	/src/fluent-bit/src/flb_hash_table.c:317
0	132	5 : View List ['flb_log_check.133', 'flb_sds_increase', 'flb_sds_avail', 'flb_sds_len.134', 'flb_log_print']	0	132	flb_sds_printf	call site: 00223	/src/fluent-bit/src/flb_sds.c:365
0	0	None	24	304	flb_utils_write_str	call site: 00040	/src/fluent-bit/src/flb_utils.c:839

Runtime coverage analysis

Covered functions

301

Functions that are reachable but not covered

47

Reachable functions

138

Percentage of reachable functions covered

65.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/utils_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_utils.c	17
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
include/fluent-bit/flb_simd.h	5
src/flb_utf8.c	2
include/fluent-bit/flb_str.h	2
src/flb_uri.c	5
src/flb_sds.c	8
include/fluent-bit/flb_uri.h	1
include/fluent-bit/flb_sds.h	3
src/flb_hash_table.c	17
src/flb_gzip.c	5
src/flb_hash.c	5
src/flb_regex.c	7
src/flb_slist.c	5

Fuzzer: flb-it-fuzz-msgpack_to_gelf_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	38	21.4%
gold	[1:9]	2	1.12%
yellow	[10:29]	1	0.56%
greenyellow	[30:49]	1	0.56%
lawngreen	50+	135	76.2%
All colors	177	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00020	/src/fluent-bit/src/flb_log.c:651
0	61	2 : View List ['flb_log_check.133', 'flb_log_print']	0	61	flb_sds_printf	call site: 00121	/src/fluent-bit/src/flb_sds.c:374
0	0	None	24	304	flb_utils_write_str	call site: 00083	/src/fluent-bit/src/flb_utils.c:839
0	0	None	18	1687	flb_msgpack_to_gelf	call site: 00037	/src/fluent-bit/src/flb_pack_gelf.c:469
0	0	None	2	71	flb_sds_create	call site: 00001	/src/fluent-bit/src/flb_sds.c:82
0	0	None	0	197	flb_sds_printf	call site: 00109	/src/fluent-bit/src/flb_sds.c:350
0	0	None	0	65	flb_sds_printf	call site: 00117	/src/fluent-bit/src/flb_sds.c:367
0	0	None	0	61	flb_sds_printf	call site: 00112	/src/fluent-bit/src/flb_sds.c:358
0	0	None	0	2	flb_msgpack_to_gelf	call site: 00067	/src/fluent-bit/src/flb_pack_gelf.c:631
0	0	None	0	2	flb_msgpack_gelf_flatten	call site: 00134	/src/fluent-bit/src/flb_pack_gelf.c:357
0	0	None	0	0	flb_log_check	call site: 00011	/src/fluent-bit/include/fluent-bit/flb_log.h:110
0	0	None	0	0	flb_calloc	call site: 00063	/src/fluent-bit/include/fluent-bit/flb_mem.h:85

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

23

Reachable functions

58

Percentage of reachable functions covered

60.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/msgpack_to_gelf_fuzzer.c	1
src/flb_sds.c	9
include/fluent-bit/flb_mem.h	5
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_pack_gelf.c	6
include/fluent-bit/flb_sds.h	4
src/flb_utils.c	1
include/fluent-bit/flb_simd.h	5
src/flb_utf8.c	2

Fuzzer: flb-it-fuzz-msgpack_parse_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	26.1%
gold	[1:9]	16	14.9%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	63	58.8%
All colors	107	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00019	/src/fluent-bit/src/flb_log.c:651
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00009	/src/fluent-bit/include/fluent-bit/flb_log.h:106
0	0	None	24	304	flb_utils_write_str	call site: 00056	/src/fluent-bit/src/flb_utils.c:839
0	0	None	2	66	flb_msgpack_raw_to_json_sds	call site: 00095	/src/fluent-bit/src/flb_pack.c:811
0	0	None	0	6	msgpack2json	call site: 00043	/src/fluent-bit/src/flb_pack.c:627
0	0	None	0	0	flb_malloc	call site: 00005	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_vector8_has_le	call site: 00050	/src/fluent-bit/include/fluent-bit/flb_simd.h:219
0	0	None	0	0	flb_log_construct	call site: 00015	/src/fluent-bit/src/flb_log.c:561
0	0	None	0	0	flb_log_construct	call site: 00017	/src/fluent-bit/src/flb_log.c:586
0	0	None	0	0	flb_log_construct	call site: 00018	/src/fluent-bit/src/flb_log.c:598
0	0	None	0	0	flb_log_print	call site: 00012	/src/fluent-bit/src/flb_log.c:646
0	0	None	0	0	flb_msgpack_to_json	call site: 00034	/src/fluent-bit/src/flb_pack.c:763

Runtime coverage analysis

Covered functions

65

Functions that are reachable but not covered

19

Reachable functions

46

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/msgpack_parse_fuzzer.c	1
src/flb_pack.c	5
src/flb_sds.c	4
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_utils.c	1
include/fluent-bit/flb_simd.h	5
src/flb_utf8.c	2
include/fluent-bit/flb_sds.h	2

Fuzzer: flb-it-fuzz-fstore_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	67	49.6%
gold	[1:9]	12	8.88%
yellow	[10:29]	3	2.22%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	39.2%
All colors	135	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	132	5 : View List ['flb_log_check.133', 'flb_sds_increase', 'flb_sds_avail', 'flb_sds_len.134', 'flb_log_print']	65	132	flb_sds_printf	call site: 00063	/src/fluent-bit/src/flb_sds.c:365
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00012	/src/fluent-bit/src/flb_log.c:651
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00002	/src/fluent-bit/include/fluent-bit/flb_log.h:106
0	69	2 : View List ['flb_log_check', 'flb_log_print']	0	69	flb_fstore_file_append	call site: 00114	/src/fluent-bit/src/flb_fstore.c:290
0	69	2 : View List ['flb_log_check', 'flb_log_print']	0	69	flb_fstore_create	call site: 00004	/src/fluent-bit/src/flb_fstore.c:479
0	0	None	130	264	flb_sds_printf	call site: 00050	/src/fluent-bit/src/flb_sds.c:348
0	0	None	2	287	flb_fstore_create	call site: 00001	/src/fluent-bit/src/flb_fstore.c:472
0	0	None	2	205	flb_fstore_stream_create	call site: 00035	/src/fluent-bit/src/flb_fstore.c:332
0	0	None	2	136	flb_fstore_stream_create	call site: 00035	/src/fluent-bit/src/flb_fstore.c:350
0	0	None	2	71	flb_sds_create	call site: 00078	/src/fluent-bit/src/flb_sds.c:82
0	0	1 : View List ['cio_chunk_up_force']	0	138	flb_fstore_file_append	call site: 00112	/src/fluent-bit/src/flb_fstore.c:280
0	0	None	0	69	log_cb	call site: 00000	/src/fluent-bit/src/flb_fstore.c:30

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

27

Reachable functions

55

Percentage of reachable functions covered

50.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/fstore_fuzzer.c	1
src/flb_fstore.c	13
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_log.c	3
src/flb_pipe.c	1
src/flb_time.c	1
include/fluent-bit/flb_mem.h	5
src/flb_sds.c	7
include/fluent-bit/flb_sds.h	3

Fuzzer: flb-it-fuzz-pack_json_state_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	63.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	36.3%
All colors	66	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
61	65	3 : View List ['flb_realloc', '__errno_location', 'flb_errno_print']	61	177	pack_string_token	call site: 00039	/src/fluent-bit/src/flb_pack.c:125
0	2	1 : View List ['octal_digit']	2	4	u8_read_escape_sequence	call site: 00045	/src/fluent-bit/src/flb_unescape.c:91
0	0	None	122	165	flb_unescape_string_utf8	call site: 00043	/src/fluent-bit/src/flb_unescape.c:176
0	0	None	122	122	flb_unescape_string_utf8	call site: 00054	/src/fluent-bit/src/flb_unescape.c:196
0	0	None	61	65	flb_json_tokenise	call site: 00034	/src/fluent-bit/src/flb_pack.c:72
0	0	None	61	61	flb_pack_state_init	call site: 00002	/src/fluent-bit/src/flb_pack.c:318
0	0	None	2	8	u8_read_escape_sequence	call site: 00047	/src/fluent-bit/src/flb_unescape.c:98
0	0	None	2	8	u8_read_escape_sequence	call site: 00049	/src/fluent-bit/src/flb_unescape.c:106
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:71
0	0	None	0	0	flb_malloc	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:76
0	0	None	0	0	flb_fuzz_get_probability	call site: 00003	/src/fluent-bit/include/fluent-bit/flb_mem.h:59
0	0	None	0	0	flb_pack_state_init	call site: 00028	/src/fluent-bit/src/flb_pack.c:328

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

24

Reachable functions

41

Percentage of reachable functions covered

41.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/pack_json_state_fuzzer.c	1
src/flb_pack.c	7
include/fluent-bit/flb_mem.h	4
src/flb_log.c	3
include/fluent-bit/flb_log.h	1
src/flb_worker.c	2
src/flb_pipe.c	1
src/flb_time.c	1
src/flb_unescape.c	5

Fuzzer: flb-it-fuzz-aws_credentials_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	218	24.0%
gold	[1:9]	275	30.3%
yellow	[10:29]	26	2.87%
greenyellow	[30:49]	9	0.99%
lawngreen	50+	377	41.6%
All colors	905	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00019	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00038	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00191	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00235	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00297	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00211	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['strcasecmp']	39	536	flb_parser_create	call site: 00322	/src/fluent-bit/src/flb_parser.c:196
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00214	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00117	/src/fluent-bit/src/flb_config.c:308
2	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_malloc.1509']	31	112	flb_parser_create	call site: 00361	/src/fluent-bit/src/flb_parser.c:249
2	61	3 : View List ['flb_free.3399', '__errno_location', 'flb_errno_print']	2	61	flb_kernel_info	call site: 00097	/src/fluent-bit/src/flb_kernel.c:137
2	2	1 : View List ['time']	2	124	flb_aws_cred_expiration	call site: 00767	/src/fluent-bit/src/aws/flb_aws_credentials.c:817

Runtime coverage analysis

Covered functions

296

Functions that are reachable but not covered

69

Reachable functions

174

Percentage of reachable functions covered

60.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/aws_credentials_fuzzer.c	5
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
src/aws/flb_aws_credentials_sts.c	3
src/aws/flb_aws_credentials.c	3
include/fluent-bit/flb_sds.h	3
src/aws/flb_aws_credentials_http.c	2
src/aws/flb_aws_credentials_process.c	8

Fuzzer: flb-it-fuzz-aws_util_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	222	24.6%
gold	[1:9]	265	29.4%
yellow	[10:29]	25	2.77%
greenyellow	[30:49]	8	0.88%
lawngreen	50+	381	42.2%
All colors	901	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00043	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00195	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00239	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00301	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00215	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['strcasecmp']	39	536	flb_parser_create	call site: 00326	/src/fluent-bit/src/flb_parser.c:196
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00218	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00121	/src/fluent-bit/src/flb_config.c:308
2	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_malloc.1509']	31	112	flb_parser_create	call site: 00365	/src/fluent-bit/src/flb_parser.c:249
2	61	3 : View List ['flb_free.3399', '__errno_location', 'flb_errno_print']	2	61	flb_kernel_info	call site: 00101	/src/fluent-bit/src/flb_kernel.c:137
0	132	5 : View List ['flb_log_check.133', 'flb_sds_increase', 'flb_sds_avail', 'flb_sds_len.134', 'flb_log_print']	0	132	flb_sds_printf	call site: 00781	/src/fluent-bit/src/flb_sds.c:365

Runtime coverage analysis

Covered functions

287

Functions that are reachable but not covered

76

Reachable functions

172

Percentage of reachable functions covered

55.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/aws_util_fuzzer.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_config.c	2
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/aws/flb_aws_util.c	7
include/fluent-bit/flb_sds.h	3
src/aws/flb_aws_credentials_sts.c	2
src/flb_random.c	1

Fuzzer: flb-it-fuzz-config_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1593	67.5%
gold	[1:9]	41	1.73%
yellow	[10:29]	14	0.59%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	709	30.0%
All colors	2357	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
547	547	1 : View List ['flb_parser_ltsv_do']	547	547	flb_parser_do	call site: 02090	/src/fluent-bit/src/flb_parser.c:1056
233	233	1 : View List ['flb_plugin_load_config_format']	233	260	flb_plugin_load_config_file	call site: 02173	/src/fluent-bit/src/flb_plugin.c:425
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00512	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
80	147	3 : View List ['flb_sds_create_size', 'flb_sds_cat_safe', '__ctype_b_loc']	84	224	flb_cf_key_translate	call site: 00887	/src/fluent-bit/src/config_format/flb_config_format.c:50
79	79	1 : View List ['flb_slist_add']	79	79	flb_slist_split_tokens	call site: 01845	/src/fluent-bit/src/flb_slist.c:204
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:651
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00196	/src/fluent-bit/src/flb_config.c:393
22	22	1 : View List ['strncasecmp']	22	22	get_section_type	call site: 00045	/src/fluent-bit/src/config_format/flb_config_format.c:178
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00240	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00302	/src/fluent-bit/src/flb_config.c:528
8	8	2 : View List ['strncmp', 'strncasecmp']	8	8	hash_get_entry	call site: 00149	/src/fluent-bit/src/flb_hash_table.c:305
5	5	2 : View List ['merge_record_and_extra_keys', 'msgpack_sbuffer_destroy.1801']	5	5	flb_parser_decoder_do	call site: 02088	/src/fluent-bit/src/flb_parser_decoder.c:537

Runtime coverage analysis

Covered functions

483

Functions that are reachable but not covered

160

Reachable functions

344

Percentage of reachable functions covered

53.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_fuzzer.c	1
src/flb_config.c	8
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	18
src/flb_sds.c	11
src/flb_kv.c	6
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	11
src/flb_env.c	7
src/flb_hash_table.c	13
src/flb_plugin.c	14
src/flb_scheduler.c	5
src/flb_parser.c	20
src/flb_regex.c	8
src/flb_parser_decoder.c	9
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_utils.c	8
src/config_format/flb_cf_fluentbit.c	10
include/fluent-bit/flb_sds.h	5
src/config_format/flb_cf_yaml.c	37
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_plugin_proxy.c	5
src/flb_api.c	2
src/proxy/go/go.c	2

Fuzzer: flb-it-fuzz-signv4_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	429	31.8%
gold	[1:9]	339	25.1%
yellow	[10:29]	36	2.67%
greenyellow	[30:49]	2	0.14%
lawngreen	50+	542	40.2%
All colors	1348	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
100	161	4 : View List ['atoi', 'flb_log_check.5895', 'flb_utils_proxy_url_split', 'flb_log_print']	100	163	flb_upstream_create	call site: 00765	/src/fluent-bit/src/flb_upstream.c:313
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00025	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00048	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	160	4 : View List ['proxy_parse', 'flb_log_check.8225', 'flb_http_client_destroy', 'flb_log_print']	22	160	flb_http_client	call site: 00850	/src/fluent-bit/src/flb_http_client.c:830
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00200	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00244	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00306	/src/fluent-bit/src/flb_config.c:528
7	16	2 : View List ['flb_kv_item_destroy', 'flb_sds_casecmp']	7	102	flb_http_add_header	call site: 00888	/src/fluent-bit/src/flb_http_client.c:958
6	6	1 : View List ['flb_tls_destroy']	6	6	flb_aws_provider_destroy	call site: 00753	/src/fluent-bit/src/aws/flb_aws_credentials.c:782
4	113	4 : View List ['flb_slist_create', 'strcmp', 'flb_slist_split_string', 'flb_slist_destroy']	4	113	flb_upstream_needs_proxy	call site: 00765	/src/fluent-bit/src/flb_upstream.c:371
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00220	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['strcasecmp']	39	536	flb_parser_create	call site: 00331	/src/fluent-bit/src/flb_parser.c:196

Runtime coverage analysis

Covered functions

329

Functions that are reachable but not covered

108

Reachable functions

251

Percentage of reachable functions covered

56.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/signv4_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/aws/flb_aws_credentials.c	3
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/flb_config.c	2
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	4
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/tls/flb_tls.c	2
src/flb_upstream.c	10
include/fluent-bit/flb_stream.h	6
src/flb_network.c	1
src/flb_utils.c	8
src/flb_http_client.c	7
include/fluent-bit/flb_sds.h	5
src/flb_signv4.c	15
src/flb_hash.c	7
src/flb_hmac.c	7
src/flb_connection.c	1

Fuzzer: flb-it-fuzz-http_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	897	65.4%
gold	[1:9]	5	0.36%
yellow	[10:29]	12	0.87%
greenyellow	[30:49]	4	0.29%
lawngreen	50+	452	32.9%
All colors	1370	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
930	930	1 : View List ['net_io_write']	937	937	flb_io_net_write	call site: 01024	/src/fluent-bit/src/flb_io.c:689
335	481	5 : View List ['flb_log_check.8225', 'flb_upstream_conn_recycle', 'flb_http_get_response_data', 'check_connection', 'flb_log_print']	335	481	flb_http_do	call site: 00957	/src/fluent-bit/src/flb_http_client.c:1505
122	122	1 : View List ['flb_http_proxy_auth']	122	1478	flb_http_client_proxy_connect	call site: 01187	/src/fluent-bit/src/flb_http_client.c:1566
100	161	4 : View List ['atoi', 'flb_log_check.5895', 'flb_utils_proxy_url_split', 'flb_log_print']	100	163	flb_upstream_create	call site: 00745	/src/fluent-bit/src/flb_upstream.c:313
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00506	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
85	85	2 : View List ['flb_tls_net_write_async', 'flb_tls_net_write']	92	92	flb_io_net_write	call site: 01024	/src/fluent-bit/src/flb_io.c:688
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00234	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00296	/src/fluent-bit/src/flb_config.c:528
11	11	1 : View List ['flb_http_stub_response']	11	11	flb_http_do	call site: 00953	/src/fluent-bit/src/flb_http_client.c:1500

Runtime coverage analysis

Covered functions

328

Functions that are reachable but not covered

164

Reachable functions

304

Percentage of reachable functions covered

46.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/http_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	8
src/flb_kv.c	3
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	4
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	8
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_upstream.c	12
include/fluent-bit/flb_stream.h	9
src/flb_network.c	30
src/flb_utils.c	2
src/flb_connection.c	10
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_http_client.c	35
include/fluent-bit/flb_sds.h	4
src/flb_base64.c	1
src/flb_io.c	8
src/flb_coro.c	1
src/flb_socket.c	1
src/flb_engine.c	1
src/tls/flb_tls.c	9

Fuzzer: flb-it-fuzz-cmetrics_decode_fuzz_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7263	20737	56 : View List ['flb_engine_manager', 'handle_input_event.5149', 'flb_task_running_print', 'flb_notification_cleanup', 'cfl_time_now', 'flb_upstream_conn_pending_destroy_list', 'flb_notification_deliver', 'flb_task_running_count', 'sb_segregate_chunks', 'mk_event_timeout_destroy', 'getenv', 'flb_sched_event_handler', 'flb_errno_print', 'flb_engine_exit', 'flb_router_io_set', 'flb_sched_timer_cb_create', 'flb_input_pause_all', 'flb_bucket_queue_find_min.5154', 'flb_input_chunk_ring_buffer_collector', 'co_active', 'flb_hs_start', 'handle_output_events', 'flb_input_collectors_start', 'flb_engine_shutdown', 'flb_output_pre_run', 'flb_me_fd_event', 'atoi', 'flb_downstream_conn_pending_destroy_list', 'sleep', 'flb_event_load_bucket_queue.5155', 'flb_sosreport', 'mk_event_wait', 'flb_sched_timer_cleanup', 'flb_engine_started', 'flb_bucket_queue_pop_min.5153', 'flb_coro_set', 'flb_engine_drain_ring_buffer_signal_channel', 'read', 'flb_engine_reschedule_retries', 'flb_utils_error', 'flb_notification_receive', 'flb_storage_metrics_create', 'flb_utils_pipe_byte_consume', 'flb_engine_flush', 'co_switch', 'flb_hs_create', 'mk_event_timeout_create', '__errno_location', 'flb_utils_timer_consume', 'exit', 'flb_input_collector_fd', 'flb_net_dns_lookup_context_cleanup', 'flb_me_create', 'mk_event_wait_2', 'flb_event_load_injected_events.5147', 'flb_time_from_double']	7263	21164	flb_engine_start	call site: 00000	/src/fluent-bit/src/flb_engine.c:842
2317	2317	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	2317	3077	flb_input_instance_init	call site: 00000	/src/fluent-bit/src/flb_input.c:1208
1760	1831	3 : View List ['flb_sched_request_destroy', 'consume_byte', 'flb_engine_dispatch_retry']	1760	1831	flb_sched_event_handler	call site: 00000	/src/fluent-bit/src/flb_scheduler.c:593
1698	1761	5 : View List ['flb_log_suppress_check.18701', 'flb_output_name', 'post_all_requests', 'flb_log_check_level.18699', 'flb_log_print']	1698	1761	cb_http_flush	call site: 00000	/src/fluent-bit/plugins/out_http/http.c:593
1684	2434	4 : View List ['flb_chunk_trace_context_destroy', 'flb_chunk_trace_input', 'flb_chunk_trace_context_hit_limit', 'flb_chunk_trace_new']	1686	2436	flb_chunk_trace_do_input	call site: 00000	/src/fluent-bit/src/flb_chunk_trace.c:542
1683	2437	2 : View List ['flb_output_task_singleplex_flush_next', 'flb_task_users_dec']	1683	2437	flb_output_task_flush	call site: 00000	/src/fluent-bit/src/flb_output.c:328
1683	1683	1 : View List ['flb_output_task_singleplex_flush_next']	1698	2781	handle_output_event	call site: 00000	/src/fluent-bit/src/flb_engine.c:284
1549	1549	1 : View List ['flb_chunk_trace_pre_output']	1549	1684	input_chunk_append_raw	call site: 00000	/src/fluent-bit/src/flb_input_chunk.c:1766
1540	1540	1 : View List ['flb_chunk_trace_output']	1544	1623	flb_output_return	call site: 00000	/src/fluent-bit/include/fluent-bit/flb_output.h:1155
1470	2448	38 : View List ['cmt_encode_msgpack_destroy', 'co_delete', 'cfl_sds_len', 'ctr_destroy', 'flb_malloc.4415', 'cprof_destroy', 'flb_errno_print', 'co_create', 'cprof_encode_msgpack_create', 'flb_sds_len.4412', 'ctr_encode_msgpack_destroy', 'flb_output_thread_instance_get', 'cmt_encode_msgpack_create', 'flb_free.4399', 'co_active', 'cprof_encode_msgpack_destroy', 'flb_event_chunk_create', 'cmt_decode_msgpack_create', 'pthread_mutex_unlock', 'flb_processor_run', 'flb_event_chunk_destroy', 'flb_output_flush_id_get', 'write', 'mk_list_del.4403', 'co_switch', 'flb_calloc.4503', 'mk_list_add.4404', 'flb_log_check.4408', 'ctr_decode_msgpack_create', '__errno_location', 'flb_mp_count', 'cmt_destroy', 'pthread_mutex_lock', 'flb_processor_is_active', 'flb_realloc.4411', 'ctr_encode_msgpack_create', 'cprof_decode_msgpack_create', 'flb_log_print']	3153	4887	flb_output_task_flush	call site: 00000	/src/fluent-bit/src/flb_output.c:323
930	930	1 : View List ['net_io_write']	937	937	flb_io_net_write	call site: 00000	/src/fluent-bit/src/flb_io.c:689
759	759	1 : View List ['memrb_input_chunk_release_space']	2310	8922	input_chunk_append_raw	call site: 00000	/src/fluent-bit/src/flb_input_chunk.c:1488

Runtime coverage analysis

Covered functions

2120

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/cmetrics_decode_fuzz.c	1

Fuzzer: flb-it-fuzz-filter_stdout_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4223	79.6%
gold	[1:9]	23	0.43%
yellow	[10:29]	142	2.67%
greenyellow	[30:49]	34	0.64%
lawngreen	50+	883	16.6%
All colors	5305	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6835	6835	2 : View List ['flb_hs_start', 'flb_hs_create']	7203	20676	flb_engine_start	call site: 04412	/src/fluent-bit/src/flb_engine.c:893
2317	2317	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	2317	3077	flb_input_instance_init	call site: 03075	/src/fluent-bit/src/flb_input.c:1208
1770	1831	3 : View List ['flb_sched_request_destroy', 'consume_byte', 'flb_engine_dispatch_retry']	1770	1831	flb_sched_event_handler	call site: 03292	/src/fluent-bit/src/flb_scheduler.c:593
1684	2434	4 : View List ['flb_chunk_trace_context_destroy', 'flb_chunk_trace_input', 'flb_chunk_trace_context_hit_limit', 'flb_chunk_trace_new']	1686	2436	flb_chunk_trace_do_input	call site: 03723	/src/fluent-bit/src/flb_chunk_trace.c:542
1683	2437	2 : View List ['flb_output_task_singleplex_flush_next', 'flb_task_users_dec']	1683	2437	flb_output_task_flush	call site: 03355	/src/fluent-bit/src/flb_output.c:328
1683	1683	1 : View List ['flb_output_task_singleplex_flush_next']	2005	2781	handle_output_event	call site: 04239	/src/fluent-bit/src/flb_engine.c:284
1549	1549	1 : View List ['flb_chunk_trace_pre_output']	1549	1684	input_chunk_append_raw	call site: 03830	/src/fluent-bit/src/flb_input_chunk.c:1766
1540	1540	1 : View List ['flb_chunk_trace_output']	1544	1623	flb_output_return	call site: 03550	/src/fluent-bit/include/fluent-bit/flb_output.h:1155
1470	2448	38 : View List ['cmt_encode_msgpack_destroy', 'co_delete', 'cfl_sds_len', 'ctr_destroy', 'flb_malloc.4415', 'cprof_destroy', 'flb_errno_print', 'co_create', 'cprof_encode_msgpack_create', 'flb_sds_len.4412', 'ctr_encode_msgpack_destroy', 'flb_output_thread_instance_get', 'cmt_encode_msgpack_create', 'flb_free.4399', 'co_active', 'cprof_encode_msgpack_destroy', 'flb_event_chunk_create', 'cmt_decode_msgpack_create', 'pthread_mutex_unlock', 'flb_processor_run', 'flb_event_chunk_destroy', 'flb_output_flush_id_get', 'write', 'mk_list_del.4403', 'co_switch', 'flb_calloc.4503', 'mk_list_add.4404', 'flb_log_check.4408', 'ctr_decode_msgpack_create', '__errno_location', 'flb_mp_count', 'cmt_destroy', 'pthread_mutex_lock', 'flb_processor_is_active', 'flb_realloc.4411', 'ctr_encode_msgpack_create', 'cprof_decode_msgpack_create', 'flb_log_print']	3153	4887	flb_output_task_flush	call site: 03353	/src/fluent-bit/src/flb_output.c:323
759	759	1 : View List ['memrb_input_chunk_release_space']	2310	8922	input_chunk_append_raw	call site: 03599	/src/fluent-bit/src/flb_input_chunk.c:1488
363	370	3 : View List ['flb_processor_run', 'flb_mp_count', 'strlen']	363	1909	input_log_append	call site: 03572	/src/fluent-bit/src/flb_input_log.c:39
307	307	5 : View List ['flb_task_users_release.5117', 'flb_task_retry_create', 'flb_sched_request_create', 'flb_task_retry_destroy', 'cmt_counter_inc']	315	865	handle_output_event	call site: 04239	/src/fluent-bit/src/flb_engine.c:291

Runtime coverage analysis

Covered functions

891

Functions that are reachable but not covered

632

Reachable functions

1061

Percentage of reachable functions covered

40.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/filter_stdout_fuzzer.c	1
src/flb_lib.c	17
include/fluent-bit/flb_mem.h	5
src/flb_config.c	6
src/flb_log.c	17
include/fluent-bit/flb_log.h	3
src/flb_worker.c	9
src/flb_pipe.c	5
src/flb_time.c	9
src/config_format/flb_config_format.c	18
src/flb_sds.c	11
src/flb_kv.c	5
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	10
src/flb_env.c	7
src/flb_hash_table.c	14
src/flb_plugin.c	14
src/flb_scheduler.c	32
src/flb_parser.c	14
src/flb_regex.c	5
src/flb_parser_decoder.c	3
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	8
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_engine.c	19
src/flb_input.c	32
include/fluent-bit/flb_input.h	3
src/flb_input_thread.c	17
include/fluent-bit/flb_sds.h	5
src/flb_router.c	6
src/flb_filter.c	10
src/flb_config_map.c	9
src/flb_metrics.c	15
src/flb_output.c	24
src/flb_output_thread.c	14
src/flb_thread_pool.c	7
src/flb_uri.c	2
src/tls/flb_tls.c	6
src/flb_callback.c	2
src/flb_task.c	17
src/flb_processor.c	14
src/flb_log_event_encoder.c	9
src/flb_log_event_encoder_dynamic_field.c	11
src/flb_log_event_decoder.c	2
src/flb_custom.c	6
src/flb_input_chunk.c	40
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	24
src/flb_event.c	3
src/flb_storage.c	13
src/flb_ring_buffer.c	6
src/flb_metrics_exporter.c	8
src/http_server/flb_hs.c	8
src/http_server/api/v1/health.c	10
src/http_server/flb_hs_endpoints.c	3
src/flb_utils.c	15
src/config_format/flb_cf_fluentbit.c	10
src/config_format/flb_cf_yaml.c	37
src/flb_plugin_proxy.c	5
src/flb_api.c	2
src/proxy/go/go.c	2
src/flb_network.c	16
src/tls/openssl.c	4
src/flb_coro.c	4
src/flb_upstream.c	17
src/flb_downstream.c	7
src/flb_pack.c	16
include/fluent-bit/flb_env.h	1
include/fluent-bit/flb_storage.h	1
include/fluent-bit/flb_simd.h	6
include/fluent-bit/flb_stream.h	4
include/fluent-bit/flb_upstream.h	1
src/flb_connection.c	3
include/fluent-bit/flb_downstream.h	1
include/fluent-bit/flb_event_loop.h	3
src/flb_engine_dispatch.c	4
src/flb_random.c	1
include/fluent-bit/flb_task.h	5
src/flb_mp.c	16
include/fluent-bit/flb_time.h	3
include/fluent-bit/flb_log_event_encoder_metadata_macros.h	1
src/flb_log_event_encoder_primitives.c	11
include/fluent-bit/flb_log_event_encoder_primitives.h	1
include/fluent-bit/flb_log_event_encoder_body_macros.h	1
include/fluent-bit/flb_byteswap.h	2
include/fluent-bit/flb_output.h	4
src/flb_input_log.c	2
plugins/in_storage_backlog/sb.c	13
include/fluent-bit/flb_scheduler.h	1
src/flb_notification.c	3
src/flb_sosreport.c	8
src/flb_utf8.c	2
src/http_server/api/v1/register.c	1
src/http_server/api/v1/uptime.c	3
src/http_server/flb_hs_utils.c	1
src/http_server/api/v1/metrics.c	12
src/http_server/api/v1/plugins.c	2
src/http_server/api/v1/trace.c	10
src/flb_unescape.c	5
src/http_server/api/v1/storage.c	6
src/http_server/api/v2/register.c	1
src/http_server/api/v2/reload.c	4
src/http_server/api/v2/metrics.c	8
include/fluent-bit/flb_router.h	1
tests/internal/fuzzers/flb_fuzz_header.h	1

Fuzzer: flb-it-fuzz-parse_logfmt_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	436	43.2%
gold	[1:9]	248	24.6%
yellow	[10:29]	15	1.48%
greenyellow	[30:49]	2	0.19%
lawngreen	50+	306	30.3%
All colors	1007	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
547	547	1 : View List ['flb_parser_ltsv_do']	547	547	flb_parser_do	call site: 00961	/src/fluent-bit/src/flb_parser.c:1056
521	521	1 : View List ['flb_parser_json_do']	521	521	flb_parser_do	call site: 00743	/src/fluent-bit/src/flb_parser.c:1052
339	339	1 : View List ['flb_parser_regex_do']	339	339	flb_parser_do	call site: 00742	/src/fluent-bit/src/flb_parser.c:1048
293	293	2 : View List ['msgpack_sbuffer_destroy.1897', 'flb_parser_decoder_do']	293	293	flb_parser_logfmt_do	call site: 01003	/src/fluent-bit/src/flb_parser_logfmt.c:314
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00234	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00296	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00213	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00116	/src/fluent-bit/src/flb_config.c:308

Runtime coverage analysis

Covered functions

278

Functions that are reachable but not covered

122

Reachable functions

207

Percentage of reachable functions covered

41.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_logfmt_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-config_random_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1216	64.4%
gold	[1:9]	43	2.27%
yellow	[10:29]	37	1.96%
greenyellow	[30:49]	9	0.47%
lawngreen	50+	581	30.8%
All colors	1886	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
819	819	1 : View List ['flb_cf_yaml_create']	819	819	flb_cf_create_from_file	call site: 00761	/src/fluent-bit/src/config_format/flb_config_format.c:900
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00511	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
80	147	3 : View List ['flb_sds_create_size', 'flb_sds_cat_safe', '__ctype_b_loc']	84	224	flb_cf_key_translate	call site: 00886	/src/fluent-bit/src/config_format/flb_config_format.c:50
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00023	/src/fluent-bit/src/flb_log.c:651
62	62	1 : View List ['flb_utils_error']	62	62	flb_parser_conf_file_stat	call site: 00749	/src/fluent-bit/src/flb_parser.c:955
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00195	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00239	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00301	/src/fluent-bit/src/flb_config.c:528
8	8	2 : View List ['strncmp', 'strncasecmp']	8	8	hash_get_entry	call site: 00148	/src/fluent-bit/src/flb_hash_table.c:305
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00215	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00218	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00121	/src/fluent-bit/src/flb_config.c:308

Runtime coverage analysis

Covered functions

510

Functions that are reachable but not covered

121

Reachable functions

255

Percentage of reachable functions covered

52.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_random_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	18
src/flb_sds.c	11
src/flb_kv.c	3
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	10
src/flb_env.c	7
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	14
src/flb_regex.c	5
src/flb_parser_decoder.c	3
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_utils.c	8
src/config_format/flb_cf_fluentbit.c	10
include/fluent-bit/flb_sds.h	5
src/config_format/flb_cf_yaml.c	37

Fuzzer: flb-it-fuzz-parse_json_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	428	42.5%
gold	[1:9]	254	25.2%
yellow	[10:29]	12	1.19%
greenyellow	[30:49]	2	0.19%
lawngreen	50+	311	30.8%
All colors	1007	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1111	1111	2 : View List ['flb_parser_logfmt_do', 'flb_parser_ltsv_do']	1111	1111	flb_parser_do	call site: 00743	/src/fluent-bit/src/flb_parser.c:1052
339	339	1 : View List ['flb_parser_regex_do']	339	339	flb_parser_do	call site: 00742	/src/fluent-bit/src/flb_parser.c:1048
293	293	3 : View List ['msgpack_unpack_next', 'flb_parser_decoder_do', 'msgpack_unpacked_init.1685']	547	608	flb_parser_json_do	call site: 00965	/src/fluent-bit/src/flb_parser_json.c:101
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:651
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00234	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00296	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['strcasecmp']	39	536	flb_parser_create	call site: 00321	/src/fluent-bit/src/flb_parser.c:196
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00213	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00116	/src/fluent-bit/src/flb_config.c:308

Runtime coverage analysis

Covered functions

331

Functions that are reachable but not covered

114

Reachable functions

207

Percentage of reachable functions covered

44.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_json_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-input_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3958	74.3%
gold	[1:9]	15	0.28%
yellow	[10:29]	6	0.11%
greenyellow	[30:49]	9	0.16%
lawngreen	50+	1338	25.1%
All colors	5326	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6835	6835	2 : View List ['flb_hs_start', 'flb_hs_create']	7262	20676	flb_engine_start	call site: 04423	/src/fluent-bit/src/flb_engine.c:893
2317	2317	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	2317	3077	flb_input_instance_init	call site: 03086	/src/fluent-bit/src/flb_input.c:1208
2060	2448	38 : View List ['cmt_encode_msgpack_destroy', 'co_delete', 'cfl_sds_len', 'ctr_destroy', 'flb_malloc.4415', 'cprof_destroy', 'flb_errno_print', 'co_create', 'cprof_encode_msgpack_create', 'flb_sds_len.4412', 'ctr_encode_msgpack_destroy', 'flb_output_thread_instance_get', 'cmt_encode_msgpack_create', 'flb_free.4399', 'co_active', 'cprof_encode_msgpack_destroy', 'flb_event_chunk_create', 'cmt_decode_msgpack_create', 'pthread_mutex_unlock', 'flb_processor_run', 'flb_event_chunk_destroy', 'flb_output_flush_id_get', 'write', 'mk_list_del.4403', 'co_switch', 'flb_calloc.4503', 'mk_list_add.4404', 'flb_log_check.4408', 'ctr_decode_msgpack_create', '__errno_location', 'flb_mp_count', 'cmt_destroy', 'pthread_mutex_lock', 'flb_processor_is_active', 'flb_realloc.4411', 'ctr_encode_msgpack_create', 'cprof_decode_msgpack_create', 'flb_log_print']	3743	4887	flb_output_task_flush	call site: 03364	/src/fluent-bit/src/flb_output.c:323
1760	1831	3 : View List ['flb_sched_request_destroy', 'consume_byte', 'flb_engine_dispatch_retry']	1760	1831	flb_sched_event_handler	call site: 03303	/src/fluent-bit/src/flb_scheduler.c:593
1698	1761	5 : View List ['flb_log_suppress_check.18701', 'flb_output_name', 'post_all_requests', 'flb_log_check_level.18699', 'flb_log_print']	1698	1761	cb_http_flush	call site: 00000	/src/fluent-bit/plugins/out_http/http.c:593
1684	2434	4 : View List ['flb_chunk_trace_context_destroy', 'flb_chunk_trace_input', 'flb_chunk_trace_context_hit_limit', 'flb_chunk_trace_new']	1686	2436	flb_chunk_trace_do_input	call site: 03734	/src/fluent-bit/src/flb_chunk_trace.c:542
1683	2437	2 : View List ['flb_output_task_singleplex_flush_next', 'flb_task_users_dec']	1683	2437	flb_output_task_flush	call site: 03366	/src/fluent-bit/src/flb_output.c:328
1683	1683	1 : View List ['flb_output_task_singleplex_flush_next']	2020	2781	handle_output_event	call site: 04250	/src/fluent-bit/src/flb_engine.c:284
1549	1549	1 : View List ['flb_chunk_trace_pre_output']	1549	1684	input_chunk_append_raw	call site: 03841	/src/fluent-bit/src/flb_input_chunk.c:1766
1540	1540	1 : View List ['flb_chunk_trace_output']	1603	1623	flb_output_return	call site: 03561	/src/fluent-bit/include/fluent-bit/flb_output.h:1155
1206	1206	1 : View List ['flb_ra_create']	1911	3017	flb_http_conf_create	call site: 00000	/src/fluent-bit/plugins/out_http/http_conf.c:75
1198	1320	7 : View List ['flb_tls_session_create', 'flb_log_check.8027', 'flb_net_socket_tcp_keepalive', 'close', 'flb_http_client_proxy_connect', 'flb_log_print', 'flb_stream_is_secure']	1198	1320	flb_io_net_connect	call site: 00000	/src/fluent-bit/src/flb_io.c:136

Runtime coverage analysis

Covered functions

1270

Functions that are reachable but not covered

537

Reachable functions

1061

Percentage of reachable functions covered

49.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/input_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_lib.c	17
src/flb_config.c	6
src/flb_log.c	17
include/fluent-bit/flb_log.h	3
src/flb_worker.c	9
src/flb_pipe.c	5
src/flb_time.c	9
src/config_format/flb_config_format.c	18
src/flb_sds.c	11
src/flb_kv.c	5
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	10
src/flb_env.c	7
src/flb_hash_table.c	14
src/flb_plugin.c	14
src/flb_scheduler.c	32
src/flb_parser.c	14
src/flb_regex.c	5
src/flb_parser_decoder.c	3
src/multiline/flb_ml.c	3
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	8
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_engine.c	19
src/flb_input.c	32
include/fluent-bit/flb_input.h	3
src/flb_input_thread.c	17
include/fluent-bit/flb_sds.h	5
src/flb_router.c	6
src/flb_filter.c	10
src/flb_config_map.c	9
src/flb_metrics.c	15
src/flb_output.c	24
src/flb_output_thread.c	14
src/flb_thread_pool.c	7
src/flb_uri.c	2
src/tls/flb_tls.c	6
src/flb_callback.c	2
src/flb_task.c	17
src/flb_processor.c	14
src/flb_log_event_encoder.c	9
src/flb_log_event_encoder_dynamic_field.c	11
src/flb_log_event_decoder.c	2
src/flb_custom.c	6
src/flb_input_chunk.c	40
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	24
src/flb_event.c	3
src/flb_storage.c	13
src/flb_ring_buffer.c	6
src/flb_metrics_exporter.c	8
src/http_server/flb_hs.c	8
src/http_server/api/v1/health.c	10
src/http_server/flb_hs_endpoints.c	3
src/flb_utils.c	15
src/config_format/flb_cf_fluentbit.c	10
src/config_format/flb_cf_yaml.c	37
src/flb_plugin_proxy.c	5
src/flb_api.c	2
src/proxy/go/go.c	2
src/flb_network.c	16
src/tls/openssl.c	4
src/flb_coro.c	4
src/flb_upstream.c	17
src/flb_downstream.c	7
src/flb_pack.c	16
include/fluent-bit/flb_env.h	1
include/fluent-bit/flb_storage.h	1
include/fluent-bit/flb_simd.h	6
include/fluent-bit/flb_stream.h	4
include/fluent-bit/flb_upstream.h	1
src/flb_connection.c	3
include/fluent-bit/flb_downstream.h	1
include/fluent-bit/flb_event_loop.h	3
src/flb_engine_dispatch.c	4
src/flb_random.c	1
include/fluent-bit/flb_task.h	5
src/flb_mp.c	16
include/fluent-bit/flb_time.h	3
include/fluent-bit/flb_log_event_encoder_metadata_macros.h	1
src/flb_log_event_encoder_primitives.c	11
include/fluent-bit/flb_log_event_encoder_primitives.h	1
include/fluent-bit/flb_log_event_encoder_body_macros.h	1
include/fluent-bit/flb_byteswap.h	2
include/fluent-bit/flb_output.h	4
src/flb_input_log.c	2
plugins/in_storage_backlog/sb.c	13
include/fluent-bit/flb_scheduler.h	1
src/flb_notification.c	3
src/flb_sosreport.c	8
src/flb_utf8.c	2
src/http_server/api/v1/register.c	1
src/http_server/api/v1/uptime.c	3
src/http_server/flb_hs_utils.c	1
src/http_server/api/v1/metrics.c	12
src/http_server/api/v1/plugins.c	2
src/http_server/api/v1/trace.c	10
src/flb_unescape.c	5
src/http_server/api/v1/storage.c	6
src/http_server/api/v2/register.c	1
src/http_server/api/v2/reload.c	4
src/http_server/api/v2/metrics.c	8
include/fluent-bit/flb_router.h	1

Fuzzer: flb-it-fuzz-multiline_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	783	55.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	629	44.5%
All colors	1413	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1111	1111	2 : View List ['flb_parser_logfmt_do', 'flb_parser_ltsv_do']	1111	1111	flb_parser_do	call site: 00920	/src/fluent-bit/src/flb_parser.c:1052
293	293	3 : View List ['msgpack_unpack_next', 'flb_parser_decoder_do', 'msgpack_unpacked_init.1685']	297	608	flb_parser_json_do	call site: 01101	/src/fluent-bit/src/flb_parser_json.c:101
293	293	2 : View List ['msgpack_sbuffer_destroy.1636', 'flb_parser_decoder_do']	293	293	flb_parser_regex_do	call site: 01048	/src/fluent-bit/src/flb_parser_regex.c:210
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00552	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
85	85	1 : View List ['flb_log_event_encoder_set_metadata_from_msgpack_object']	85	437	flb_ml_append_object	call site: 01369	/src/fluent-bit/src/multiline/flb_ml.c:892
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00024	/src/fluent-bit/src/flb_log.c:651
61	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_malloc.1509']	112	112	flb_parser_create	call site: 00406	/src/fluent-bit/src/flb_parser.c:249
61	61	3 : View List ['flb_free.3399', '__errno_location', 'flb_errno_print']	61	61	flb_kernel_info	call site: 00144	/src/fluent-bit/src/flb_kernel.c:137
46	46	1 : View List ['flb_log_event_encoder_append_legacy_timestamp']	46	46	flb_log_event_encoder_append_timestamp	call site: 01271	/src/fluent-bit/src/flb_log_event_encoder_primitives.c:479
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00086	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00238	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00282	/src/fluent-bit/src/flb_config.c:479

Runtime coverage analysis

Covered functions

502

Functions that are reachable but not covered

304

Reachable functions

515

Percentage of reachable functions covered

40.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/multiline_fuzzer.c	3
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_pack.c	9
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	4
src/flb_unescape.c	7
src/flb_config.c	2
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	9
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	27
src/multiline/flb_ml_parser.c	9
src/multiline/flb_ml_rule.c	11
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_log_event_decoder.c	4
src/flb_log_event_encoder.c	10
src/flb_log_event_encoder_dynamic_field.c	12
src/multiline/flb_ml_group.c	3
src/multiline/flb_ml_stream.c	9
src/flb_mp.c	8
include/fluent-bit/flb_time.h	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	5
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2
src/flb_log_event_encoder_primitives.c	29
include/fluent-bit/flb_log_event_encoder_primitives.h	1
include/fluent-bit/flb_byteswap.h	2
include/fluent-bit/flb_log_event_encoder_body_macros.h	2
include/fluent-bit/flb_log_event_encoder_metadata_macros.h	1

Fuzzer: flb-it-fuzz-config_map_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	251	25.7%
gold	[1:9]	258	26.5%
yellow	[10:29]	45	4.62%
greenyellow	[30:49]	10	1.02%
lawngreen	50+	409	42.0%
All colors	973	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
76	81	2 : View List ['flb_sds_destroy', 'buf_append']	76	219	flb_env_var_translate	call site: 00808	/src/fluent-bit/src/flb_env.c:240
65	132	5 : View List ['flb_log_check.133', 'flb_sds_increase', 'flb_sds_avail', 'flb_sds_len.134', 'flb_log_print']	65	132	flb_sds_printf	call site: 00939	/src/fluent-bit/src/flb_sds.c:365
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00023	/src/fluent-bit/src/flb_log.c:651
65	65	1 : View List ['flb_sds_increase']	65	65	flb_sds_copy	call site: 00813	/src/fluent-bit/src/flb_sds.c:267
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00042	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00194	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00238	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00300	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00214	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['strcasecmp']	39	536	flb_parser_create	call site: 00325	/src/fluent-bit/src/flb_parser.c:196
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00217	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00120	/src/fluent-bit/src/flb_config.c:308

Runtime coverage analysis

Covered functions

297

Functions that are reachable but not covered

73

Reachable functions

185

Percentage of reachable functions covered

60.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/config_map_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_config.c	2
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	9
src/flb_kv.c	5
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	9
src/flb_env.c	7
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	5
src/flb_regex.c	5
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_config_map.c	13
include/fluent-bit/flb_env.h	1
include/fluent-bit/flb_sds.h	4
src/flb_utils.c	3

Fuzzer: flb-it-fuzz-parser_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	485	45.9%
gold	[1:9]	7	0.66%
yellow	[10:29]	6	0.56%
greenyellow	[30:49]	3	0.28%
lawngreen	50+	554	52.5%
All colors	1055	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00506	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
65	65	2 : View List ['flb_pipe_write_all', 'perror']	65	65	flb_log_print	call site: 00018	/src/fluent-bit/src/flb_log.c:651
61	61	3 : View List ['flb_free.3399', '__errno_location', 'flb_errno_print']	61	61	flb_kernel_info	call site: 00096	/src/fluent-bit/src/flb_kernel.c:137
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:172
22	22	1 : View List ['flb_log_destroy']	66	253	flb_config_exit	call site: 00190	/src/fluent-bit/src/flb_config.c:393
19	19	1 : View List ['flb_sched_destroy']	30	152	flb_config_exit	call site: 00234	/src/fluent-bit/src/flb_config.c:479
11	11	1 : View List ['flb_bucket_queue_destroy']	11	76	flb_config_exit	call site: 00296	/src/fluent-bit/src/flb_config.c:528
4	4	1 : View List ['flb_pipe_destroy']	42	223	flb_config_exit	call site: 00210	/src/fluent-bit/src/flb_config.c:419
4	4	1 : View List ['close']	34	215	flb_config_exit	call site: 00213	/src/fluent-bit/src/flb_config.c:432
4	4	1 : View List ['getpagesize']	8	1573	flb_config_init	call site: 00116	/src/fluent-bit/src/flb_config.c:308
4	4	2 : View List ['ntohl', 'ntohs']	4	297	flb_parser_regex_do	call site: 00793	/src/fluent-bit/src/flb_parser_regex.c:188
2	2	1 : View List ['flb_worker_log_level']	2	2	flb_log_check	call site: 00008	/src/fluent-bit/include/fluent-bit/flb_log.h:106

Runtime coverage analysis

Covered functions

391

Functions that are reachable but not covered

80

Reachable functions

210

Percentage of reachable functions covered

61.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parser_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
tests/internal/fuzzers/flb_fuzz_header.h	1
src/flb_utils.c	1
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2

Fuzzer: flb-it-fuzz-engine_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	989	82.2%
gold	[1:9]	95	7.89%
yellow	[10:29]	34	2.82%
greenyellow	[30:49]	19	1.57%
lawngreen	50+	66	5.48%
All colors	1203	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
19859	20737	56 : View List ['flb_engine_manager', 'handle_input_event.5149', 'flb_task_running_print', 'flb_notification_cleanup', 'cfl_time_now', 'flb_upstream_conn_pending_destroy_list', 'flb_notification_deliver', 'flb_task_running_count', 'sb_segregate_chunks', 'mk_event_timeout_destroy', 'getenv', 'flb_sched_event_handler', 'flb_errno_print', 'flb_engine_exit', 'flb_router_io_set', 'flb_sched_timer_cb_create', 'flb_input_pause_all', 'flb_bucket_queue_find_min.5154', 'flb_input_chunk_ring_buffer_collector', 'co_active', 'flb_hs_start', 'handle_output_events', 'flb_input_collectors_start', 'flb_engine_shutdown', 'flb_output_pre_run', 'flb_me_fd_event', 'atoi', 'flb_downstream_conn_pending_destroy_list', 'sleep', 'flb_event_load_bucket_queue.5155', 'flb_sosreport', 'mk_event_wait', 'flb_sched_timer_cleanup', 'flb_engine_started', 'flb_bucket_queue_pop_min.5153', 'flb_coro_set', 'flb_engine_drain_ring_buffer_signal_channel', 'read', 'flb_engine_reschedule_retries', 'flb_utils_error', 'flb_notification_receive', 'flb_storage_metrics_create', 'flb_utils_pipe_byte_consume', 'flb_engine_flush', 'co_switch', 'flb_hs_create', 'mk_event_timeout_create', '__errno_location', 'flb_utils_timer_consume', 'exit', 'flb_input_collector_fd', 'flb_net_dns_lookup_context_cleanup', 'flb_me_create', 'mk_event_wait_2', 'flb_event_load_injected_events.5147', 'flb_time_from_double']	19859	21164	flb_engine_start	call site: 00000	/src/fluent-bit/src/flb_engine.c:842
3026	5474	20 : View List ['flb_output_plugin_property_check', 'cmt_gauge_create', 'flb_output_net_property_check', 'cfl_time_now', 'flb_output_enable_multi_threading', 'flb_log_print', 'flb_tls_set_verify_hostname', 'cmt_gauge_set', 'flb_metrics_add', 'cmt_counter_set', 'flb_log_check.4408', 'cmt_create', 'flb_output_name', 'flb_tls_create', 'flb_processor_init', 'mk_event_channel_create', 'flb_net_setup_init', 'flb_metrics_create', 'cmt_counter_create', 'flb_tls_get_config_map']	3026	6260	flb_output_init_all	call site: 00000	/src/fluent-bit/src/flb_output.c:1280
2317	2317	2 : View List ['flb_input_thread_instance_init', 'flb_ring_buffer_add_event_loop']	2317	3077	flb_input_instance_init	call site: 00000	/src/fluent-bit/src/flb_input.c:1208
823	884	4 : View List ['flb_log_check.2734', 'flb_destroy', 'flb_stop', 'flb_log_print']	823	884	flb_create	call site: 00000	/src/fluent-bit/src/flb_lib.c:206
187	248	3 : View List ['flb_log_check.90', 'flb_config_exit', 'flb_log_print']	187	248	flb_config_init	call site: 00000	/src/fluent-bit/src/flb_config.c:361
146	207	4 : View List ['parse_string_map_to_list', 'flb_log_check.4757', 'flb_free.4759', 'flb_log_print']	146	207	translate_default_value	call site: 00000	/src/fluent-bit/src/flb_config_map.c:168
146	146	2 : View List ['flb_tls_set_verify_hostname', 'flb_tls_create']	2463	5727	flb_input_instance_init	call site: 00000	/src/fluent-bit/src/flb_input.c:1120
126	126	4 : View List ['flb_task_queue_create', 'flb_free.4399', '__errno_location', 'flb_errno_print']	126	197	flb_output_new	call site: 00093	/src/fluent-bit/src/flb_output.c:710
109	109	1 : View List ['flb_input_thread_instance_exit']	109	109	flb_input_instance_exit	call site: 00467	/src/fluent-bit/src/flb_input.c:1343
93	95	2 : View List ['flb_log_cache_check_suppress', 'flb_worker_get']	93	95	flb_log_suppress_check	call site: 00228	/src/fluent-bit/include/fluent-bit/flb_log.h:143
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00000	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
76	81	2 : View List ['flb_sds_destroy', 'buf_append']	76	219	flb_env_var_translate	call site: 00000	/src/fluent-bit/src/flb_env.c:240

Runtime coverage analysis

Covered functions

545

Functions that are reachable but not covered

258

Reachable functions

358

Percentage of reachable functions covered

27.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/engine_fuzzer.c	1
tests/internal/fuzzers/flb_fuzz_header.h	1
include/fluent-bit/flb_mem.h	5
src/flb_lib.c	8
src/flb_output.c	9
src/flb_log.c	9
include/fluent-bit/flb_log.h	3
src/flb_worker.c	4
src/flb_pipe.c	2
src/flb_time.c	8
src/flb_callback.c	2
src/flb_hash_table.c	13
src/flb_task.c	6
src/flb_network.c	1
src/flb_sds.c	7
src/flb_uri.c	2
include/fluent-bit/flb_str.h	2
src/flb_kv.c	4
src/flb_processor.c	9
src/flb_filter.c	8
src/flb_input.c	23
src/flb_ring_buffer.c	5
src/flb_config.c	2
include/fluent-bit/flb_sds.h	4
src/flb_input_chunk.c	38
src/flb_routes_mask.c	5
src/flb_chunk_trace.c	17
include/fluent-bit/flb_input.h	1
src/flb_input_thread.c	3
src/flb_engine.c	3
src/flb_router.c	3
src/flb_config_map.c	2
src/flb_slist.c	1
src/flb_regex.c	1
src/flb_metrics.c	3
src/flb_output_thread.c	1
src/flb_thread_pool.c	1
src/tls/flb_tls.c	1
src/flb_log_event_encoder.c	9
src/flb_log_event_encoder_dynamic_field.c	11
src/flb_log_event_decoder.c	2
src/flb_custom.c	3
src/flb_scheduler.c	6
src/flb_event.c	1
src/flb_storage.c	2
src/flb_metrics_exporter.c	1
src/http_server/flb_hs.c	1
src/http_server/api/v1/health.c	1
src/http_server/flb_hs_endpoints.c	1
src/flb_kernel.c	1
src/flb_env.c	1
src/flb_plugin.c	2
src/flb_parser.c	2
src/flb_parser_decoder.c	1
src/multiline/flb_ml.c	1
src/multiline/flb_ml_parser.c	2
src/multiline/flb_ml_rule.c	2
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	1
src/config_format/flb_config_format.c	5
include/fluent-bit/flb_task.h	2
src/flb_mp.c	16
plugins/in_storage_backlog/sb.c	6
src/flb_pack.c	1
src/flb_input_log.c	2
include/fluent-bit/flb_time.h	2
include/fluent-bit/flb_log_event_encoder_metadata_macros.h	1
src/flb_log_event_encoder_primitives.c	11
include/fluent-bit/flb_log_event_encoder_primitives.h	1
include/fluent-bit/flb_log_event_encoder_body_macros.h	1
include/fluent-bit/flb_byteswap.h	2

Fuzzer: flb-it-fuzz-parse_ltsv_fuzzer_OSSFUZZ

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	735	72.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	272	27.0%
All colors	1007	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
564	564	1 : View List ['flb_parser_logfmt_do']	564	564	flb_parser_do	call site: 00961	/src/fluent-bit/src/flb_parser.c:1056
521	521	1 : View List ['flb_parser_json_do']	521	521	flb_parser_do	call site: 00743	/src/fluent-bit/src/flb_parser.c:1052
339	339	1 : View List ['flb_parser_regex_do']	339	339	flb_parser_do	call site: 00742	/src/fluent-bit/src/flb_parser.c:1048
293	293	2 : View List ['flb_parser_decoder_do', 'msgpack_sbuffer_destroy.1839']	293	293	flb_parser_ltsv_do	call site: 00986	/src/fluent-bit/src/flb_parser_ltsv.c:257
87	87	1 : View List ['rule_error']	87	87	flb_ml_parser_python	call site: 00506	/src/fluent-bit/src/multiline/flb_ml_parser_python.c:84
61	248	3 : View List ['flb_log_check.90', 'flb_config_exit', 'flb_log_print']	61	248	flb_config_init	call site: 00517	/src/fluent-bit/src/flb_config.c:361
61	89	3 : View List ['flb_ml_parser_destroy', 'flb_log_check.8467', 'flb_log_print']	61	89	flb_ml_parser_go	call site: 00484	/src/fluent-bit/src/multiline/flb_ml_parser_go.c:133
61	89	3 : View List ['flb_ml_parser_destroy', 'flb_log_check.8431', 'flb_log_print']	61	89	flb_ml_parser_java	call site: 00455	/src/fluent-bit/src/multiline/flb_ml_parser_java.c:136
61	89	3 : View List ['flb_ml_parser_destroy', 'flb_log_check.8505', 'flb_log_print']	61	89	flb_ml_parser_ruby	call site: 00493	/src/fluent-bit/src/multiline/flb_ml_parser_ruby.c:80
61	61	3 : View List ['flb_errno_print', '__errno_location', 'flb_malloc.1509']	112	112	flb_parser_create	call site: 00360	/src/fluent-bit/src/flb_parser.c:249
61	61	3 : View List ['flb_free.3399', '__errno_location', 'flb_errno_print']	61	61	flb_kernel_info	call site: 00096	/src/fluent-bit/src/flb_kernel.c:137
26	26	1 : View List ['strncasecmp']	26	26	get_section_type	call site: 00037	/src/fluent-bit/src/config_format/flb_config_format.c:172

Runtime coverage analysis

Covered functions

264

Functions that are reachable but not covered

134

Reachable functions

207

Percentage of reachable functions covered

35.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/internal/fuzzers/parse_ltsv_fuzzer.c	1
src/flb_config.c	2
include/fluent-bit/flb_mem.h	5
src/flb_log.c	6
include/fluent-bit/flb_log.h	1
src/flb_worker.c	5
src/flb_pipe.c	2
src/flb_time.c	1
src/config_format/flb_config_format.c	8
src/flb_sds.c	7
src/flb_kv.c	2
src/flb_kernel.c	2
include/fluent-bit/flb_str.h	3
src/flb_slist.c	5
src/flb_env.c	4
src/flb_hash_table.c	13
src/flb_plugin.c	3
src/flb_scheduler.c	5
src/flb_parser.c	11
src/flb_regex.c	8
src/flb_parser_decoder.c	7
src/multiline/flb_ml.c	2
src/multiline/flb_ml_parser.c	5
src/multiline/flb_ml_rule.c	8
include/fluent-bit/flb_bucket_queue.h	3
include/fluent-bit/flb_plugins.h	2
src/multiline/flb_ml_parser_docker.c	2
src/multiline/flb_ml_parser_cri.c	2
src/multiline/flb_ml_parser_java.c	2
src/multiline/flb_ml_parser_go.c	2
src/multiline/flb_ml_parser_ruby.c	2
src/multiline/flb_ml_parser_python.c	2
src/flb_parser_regex.c	2
src/flb_strptime.c	6
include/fluent-bit/flb_parser.h	1
include/fluent-bit/flb_sds.h	3
src/flb_pack.c	8
src/flb_unescape.c	7
src/flb_parser_json.c	1
src/flb_parser_ltsv.c	2
src/flb_parser_logfmt.c	2