High level conclusions

Fuzzers reach 42.60% of cyclomatic complexity.

Fuzzers reach 38.66% of all functions.

Fuzzer TestFuzzClientRdpFile is blocked:

The runtime code coverage of TestFuzzClientRdpFile covers 28.60% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer TestFuzzServer is blocked:

The runtime code coverage of TestFuzzServer covers 25.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3293 / 8516

Cyclomatic complexity statically reachable by fuzzers

25664 / 60235

Runtime code coverage of functions

2323 / 8516

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: TestFuzzChannelCliprdr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	36.7%
gold	[1:9]	62	16.1%
yellow	[10:29]	10	2.60%
greenyellow	[30:49]	5	1.30%
lawngreen	50+	166	43.2%
All colors	384	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	170	WLog_ConsoleAppender_New	call site: 00170	WLog_FileAppender_New
16	115	NtCurrentTeb	call site: 00115	GetEnvironmentVariableA
14	214	WLog_ParseFilters	call site: 00214	WLog_AddStringLogFilters_int
7	73	EnterCriticalSection	call site: 00073	log_recursion
7	158	WLog_InitializeRoot	call site: 00158	GetEnvironmentVariableA
6	12	WLog_IsLevelActive	call site: 00012	WLog_GetFilterLogLevel
5	84	InterlockedDecrement	call site: 00084	UnWaitCriticalSection
4	42	unwind_backtrace_callback	call site: 00042	WLog_Print_dbg_tag
4	68	GetCurrentThreadId	call site: 00068	WaitForCriticalSection
4	151	WLog_AddChild	call site: 00151	WLog_Free
4	230	winpr_atexit	call site: 00230	WLog_Print_dbg_tag
4	249	Stream_GetRemainingLength	call site: 00249	winpr_log_backtrace

Runtime coverage analysis

Covered functions

106

Functions that are reachable but not covered

64

Reachable functions

155

Percentage of reachable functions covered

58.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
channels/cliprdr/client/test/TestFuzzChannelCliprdr.c	8
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	4
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/utils/stream.c	8
channels/cliprdr/cliprdr_common.c	8
winpr/include/winpr/stream.h	4
winpr/include/winpr/endian.h	1
winpr/libwinpr/crt/unicode.c	3
winpr/libwinpr/crt/unicode_builtin.c	4

Fuzzer: TestFuzzCredSSP_Asn1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	131	32.5%
gold	[1:9]	68	16.8%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	50.6%
All colors	403	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	182	WLog_Appender_New	call site: 00182	WLog_UdpAppender_New
14	117	NtCurrentTeb	call site: 00117	GetEnvironmentVariableA
14	167	WLog_ConsoleAppender_New	call site: 00167	WLog_FileAppender_New
14	211	WLog_ParseFilters	call site: 00211	WLog_AddStringLogFilters_int
9	49	unwind_backtrace_callback	call site: 00049	WLog_Print_dbg_tag
7	79	EnterCriticalSection	call site: 00079	log_recursion
7	155	WLog_InitializeRoot	call site: 00155	GetEnvironmentVariableA
5	20	WLog_GetLogLevel	call site: 00020	_stricmp
5	90	InterlockedDecrement	call site: 00090	UnWaitCriticalSection
4	74	GetCurrentThreadId	call site: 00074	WaitForCriticalSection
4	227	winpr_atexit	call site: 00227	WLog_Print_dbg_tag
4	234	WLog_Uninit_	call site: 00234	WLog_Uninit_

Runtime coverage analysis

Covered functions

113

Functions that are reachable but not covered

60

Reachable functions

157

Percentage of reachable functions covered

61.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
winpr/libwinpr/utils/test/TestFuzzCredSSP_Asn1.c	3
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	2
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	1
winpr/include/winpr/asn1.h	1
winpr/include/winpr/stream.h	8
winpr/libwinpr/utils/asn1/asn1.c	20
winpr/libwinpr/utils/stream.c	7
winpr/include/winpr/endian.h	2

Fuzzer: TestFuzzNTLMMessage

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	138	37.1%
gold	[1:9]	95	25.6%
yellow	[10:29]	3	0.80%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	135	36.3%
All colors	371	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	182	WLog_Appender_New	call site: 00182	WLog_UdpAppender_New
14	117	NtCurrentTeb	call site: 00117	GetEnvironmentVariableA
14	167	WLog_ConsoleAppender_New	call site: 00167	WLog_FileAppender_New
14	211	WLog_ParseFilters	call site: 00211	WLog_AddStringLogFilters_int
7	79	EnterCriticalSection	call site: 00079	log_recursion
7	155	WLog_InitializeRoot	call site: 00155	GetEnvironmentVariableA
5	20	WLog_GetLogLevel	call site: 00020	_stricmp
5	90	InterlockedDecrement	call site: 00090	UnWaitCriticalSection
5	259	winpr_InitializeSSL	call site: 00259	WLog_Print_dbg_tag
4	49	unwind_backtrace_callback	call site: 00049	WLog_Print_dbg_tag
4	74	GetCurrentThreadId	call site: 00074	WaitForCriticalSection
4	227	winpr_atexit	call site: 00227	WLog_Print_dbg_tag

Runtime coverage analysis

Covered functions

339

Functions that are reachable but not covered

59

Reachable functions

148

Percentage of reachable functions covered

60.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
winpr/libwinpr/sspi/test/TestFuzzNTLMMessage.c	11
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	3
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	5
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/sspi/sspi.c	4
winpr/libwinpr/sspi/sspi_winpr.c	9
winpr/libwinpr/utils/ssl.c	5
winpr/libwinpr/sspi/Schannel/schannel.c	1
winpr/libwinpr/crt/unicode.c	4
winpr/libwinpr/crt/unicode_builtin.c	5
winpr/libwinpr/sspi/Kerberos/kerberos.c	1
winpr/libwinpr/sspi/NTLM/ntlm.c	1
winpr/libwinpr/sspi/CredSSP/credssp.c	1
winpr/libwinpr/sspi/Negotiate/negotiate.c	1
winpr/libwinpr/crt/memory.c	1

Fuzzer: TestFuzzWinPRClipboard

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	453	34.0%
gold	[1:9]	91	6.84%
yellow	[10:29]	15	1.12%
greenyellow	[30:49]	2	0.15%
lawngreen	50+	769	57.8%
All colors	1330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	856	clipboard_synthesize_ms_html_format	call site: 00856	ConvertWCharNToUtf8Alloc
30	1217	convert_filedescriptors_to_file_list	call site: 01217	ConvertWCharNToUtf8
22	1249	register_file_formats_and_synthesizers	call site: 01249	process_gnome_copied_files
19	182	WLog_Appender_New	call site: 00182	WLog_UdpAppender_New
16	828	clipboard_synthesize_html_format	call site: 00828	ConvertLineEndingToLF
15	740	winpr_bitmap_write_buffer	call site: 00740	clipboard_wrap_html
14	117	NtCurrentTeb	call site: 00117	GetEnvironmentVariableA
14	167	WLog_ConsoleAppender_New	call site: 00167	WLog_FileAppender_New
14	211	WLog_ParseFilters	call site: 00211	WLog_AddStringLogFilters_int
10	1121	free_synthetic_file	call site: 01121	CloseHandle
9	385	clipboard_synthesize_string	call site: 00385	ClipboardRegisterSynthesizerEx
9	1282	register_file_formats_and_synthesizers	call site: 01282	process_mate_copied_files

Runtime coverage analysis

Covered functions

268

Functions that are reachable but not covered

104

Reachable functions

354

Percentage of reachable functions covered

70.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
winpr/libwinpr/clipboard/test/TestFuzzWinPRClipboard.c	1
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	18
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/clipboard/clipboard.c	18
winpr/libwinpr/clipboard/synthetic.c	21
winpr/libwinpr/crt/unicode.c	15
winpr/libwinpr/crt/unicode_builtin.c	8
winpr/include/winpr/endian.h	9
winpr/libwinpr/crt/memory.c	1
winpr/libwinpr/utils/stream.c	16
winpr/include/winpr/stream.h	19
winpr/libwinpr/utils/image.c	19
winpr/include/winpr/crt.h	1
winpr/libwinpr/clipboard/synthetic_file.c	33
winpr/libwinpr/utils/collections/ArrayList.c	11
winpr/libwinpr/file/generic.c	11
winpr/libwinpr/path/path.c	6
winpr/libwinpr/file/file.c	1
winpr/libwinpr/nt/ntstatus.c	2
winpr/libwinpr/file/pattern.c	3
winpr/libwinpr/handle/handle.c	1
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1

Fuzzer: TestFuzzNSCodec

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	161	32.7%
gold	[1:9]	174	35.3%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	157	31.9%
All colors	492	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	167	WLog_ConsoleAppender_New	call site: 00167	WLog_FileAppender_New
14	117	NtCurrentTeb	call site: 00117	GetEnvironmentVariableA
14	211	WLog_ParseFilters	call site: 00211	WLog_AddStringLogFilters_int
7	79	EnterCriticalSection	call site: 00079	log_recursion
7	155	WLog_InitializeRoot	call site: 00155	GetEnvironmentVariableA
6	280	nsc_process_message	call site: 00280	WLog_PrintTextMessage
5	20	WLog_GetLogLevel	call site: 00020	_stricmp
5	90	InterlockedDecrement	call site: 00090	UnWaitCriticalSection
4	49	unwind_backtrace_callback	call site: 00049	WLog_Print_dbg_tag
4	74	GetCurrentThreadId	call site: 00074	WaitForCriticalSection
4	227	winpr_atexit	call site: 00227	WLog_Print_dbg_tag
4	234	WLog_Uninit_	call site: 00234	WLog_Uninit_

Runtime coverage analysis

Covered functions

179

Functions that are reachable but not covered

66

Reachable functions

217

Percentage of reachable functions covered

69.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/codec/test/TestFuzzNSCodec.c	2
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	2
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	1
libfreerdp/codec/nsc.c	9
winpr/libwinpr/crt/alignment.c	7
libfreerdp/codec/sse/nsc_sse2.h	1
winpr/libwinpr/sysinfo/sysinfo.c	3
libfreerdp/codec/sse/nsc_sse2.c	1
libfreerdp/codec/neon/nsc_neon.h	1
libfreerdp/codec/neon/nsc_neon.c	1
include/freerdp/codec/color.h	2
winpr/libwinpr/utils/stream.c	6
winpr/include/winpr/stream.h	4
winpr/include/winpr/endian.h	2
libfreerdp/codec/color.c	2
libfreerdp/primitives/primitives.c	11
libfreerdp/primitives/prim_add.c	2
libfreerdp/primitives/prim_andor.c	2
libfreerdp/primitives/prim_alphaComp.c	2
libfreerdp/primitives/prim_copy.c	2
libfreerdp/primitives/prim_set.c	2
libfreerdp/primitives/prim_shift.c	2
libfreerdp/primitives/prim_sign.c	2
libfreerdp/primitives/prim_colors.c	2
libfreerdp/primitives/prim_YCoCg.c	2
libfreerdp/primitives/prim_YUV.c	2
libfreerdp/primitives/prim_add.h	1
libfreerdp/primitives/sse/prim_add_sse3.c	1
libfreerdp/primitives/prim_andor.h	1
libfreerdp/primitives/sse/prim_andor_sse3.c	1
libfreerdp/primitives/prim_alphaComp.h	1
libfreerdp/primitives/sse/prim_alphaComp_sse3.c	1
libfreerdp/primitives/prim_copy.h	2
libfreerdp/primitives/sse/prim_copy_sse4_1.c	1
libfreerdp/primitives/sse/prim_copy_avx2.c	1
libfreerdp/primitives/prim_set.h	1
libfreerdp/primitives/sse/prim_set_sse2.c	1
libfreerdp/primitives/prim_shift.h	1
libfreerdp/primitives/sse/prim_shift_sse3.c	1
libfreerdp/primitives/prim_sign.h	1
libfreerdp/primitives/sse/prim_sign_ssse3.c	1
libfreerdp/primitives/prim_colors.h	2
libfreerdp/primitives/sse/prim_colors_sse2.c	1
libfreerdp/primitives/neon/prim_colors_neon.c	1
libfreerdp/primitives/prim_YCoCg.h	2
libfreerdp/primitives/sse/prim_YCoCg_ssse3.c	1
libfreerdp/primitives/neon/prim_YCoCg_neon.c	1
libfreerdp/primitives/prim_YUV.h	2
libfreerdp/primitives/sse/prim_YUV_sse4.1.c	1
libfreerdp/primitives/neon/prim_YUV_neon.c	1

Fuzzer: TestFuzzCodecs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1325	45.7%
gold	[1:9]	203	7.01%
yellow	[10:29]	43	1.48%
greenyellow	[30:49]	22	0.75%
lawngreen	50+	1302	44.9%
All colors	2895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
442	1398	rfx_process_message_channels	call site: 01398	rfx_process_message_tileset
133	2423	progressive_process_tiles	call site: 02423	winpr_CreateThreadpoolWork
123	1843	winpr_GetUnixTimeNS	call site: 01843	winpr_SetThreadpoolThreadMaximum
63	1117	winpr_fopen	call site: 01117	reg_load
34	179	WLog_ConsoleAppender_New	call site: 00179	WLog_FileAppender_New
27	1065	GetKnownSubPathVA	call site: 01065	GetPath_XDG_CONFIG_HOME
27	1274	rfx_message_clear	call site: 01274	BufferPool_Return
25	2049	region16_clear	call site: 02049	freerdp_image_copy_no_overlap
25	2715	interleaved_decompress	call site: 02715	RleDecompress8to8
23	1234	WINPR_JSON_ParseFromFile	call site: 01234	WINPR_JSON_ParseFromFileFP
22	1183	reg_unload	call site: 01183	RegQueryValueExA
16	124	NtCurrentTeb	call site: 00124	GetEnvironmentVariableA

Runtime coverage analysis

Covered functions

438

Functions that are reachable but not covered

317

Reachable functions

719

Percentage of reachable functions covered

55.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/codec/test/TestFuzzCodecs.c	20
libfreerdp/codec/clear.c	16
winpr/libwinpr/crt/alignment.c	9
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	5
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/thread/thread.c	26
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
libfreerdp/codec/nsc.c	10
libfreerdp/codec/sse/nsc_sse2.h	1
winpr/libwinpr/sysinfo/sysinfo.c	10
libfreerdp/codec/sse/nsc_sse2.c	1
libfreerdp/codec/neon/nsc_neon.h	1
libfreerdp/codec/neon/nsc_neon.c	1
libfreerdp/codec/color.c	8
libfreerdp/codec/color.h	3
include/freerdp/codec/color.h	4
winpr/libwinpr/utils/stream.c	12
winpr/include/winpr/stream.h	11
winpr/include/winpr/endian.h	3
libfreerdp/primitives/primitives.c	11
libfreerdp/primitives/prim_add.c	2
libfreerdp/primitives/prim_andor.c	2
libfreerdp/primitives/prim_alphaComp.c	2
libfreerdp/primitives/prim_copy.c	2
libfreerdp/primitives/prim_set.c	2
libfreerdp/primitives/prim_shift.c	2
libfreerdp/primitives/prim_sign.c	2
libfreerdp/primitives/prim_colors.c	2
libfreerdp/primitives/prim_YCoCg.c	2
libfreerdp/primitives/prim_YUV.c	2
libfreerdp/primitives/prim_add.h	1
libfreerdp/primitives/sse/prim_add_sse3.c	1
libfreerdp/primitives/prim_andor.h	1
libfreerdp/primitives/sse/prim_andor_sse3.c	1
libfreerdp/primitives/prim_alphaComp.h	1
libfreerdp/primitives/sse/prim_alphaComp_sse3.c	1
libfreerdp/primitives/prim_copy.h	2
libfreerdp/primitives/sse/prim_copy_sse4_1.c	1
libfreerdp/primitives/sse/prim_copy_avx2.c	1
libfreerdp/primitives/prim_set.h	1
libfreerdp/primitives/sse/prim_set_sse2.c	1
libfreerdp/primitives/prim_shift.h	1
libfreerdp/primitives/sse/prim_shift_sse3.c	1
libfreerdp/primitives/prim_sign.h	1
libfreerdp/primitives/sse/prim_sign_ssse3.c	1
libfreerdp/primitives/prim_colors.h	2
libfreerdp/primitives/sse/prim_colors_sse2.c	1
libfreerdp/primitives/neon/prim_colors_neon.c	1
libfreerdp/primitives/prim_YCoCg.h	2
libfreerdp/primitives/sse/prim_YCoCg_ssse3.c	1
libfreerdp/primitives/neon/prim_YCoCg_neon.c	1
libfreerdp/primitives/prim_YUV.h	2
libfreerdp/primitives/sse/prim_YUV_sse4.1.c	1
libfreerdp/primitives/neon/prim_YUV_neon.c	1
libfreerdp/codec/xcrush.c	7
libfreerdp/codec/mppc.c	4
winpr/libwinpr/utils/collections/BitStream.c	3
winpr/include/winpr/bitstream.h	4
libfreerdp/codec/zgfx.c	9
libfreerdp/codec/ncrush.c	8
libfreerdp/codec/rfx.c	24
winpr/libwinpr/utils/collections/ObjectPool.c	9
winpr/libwinpr/utils/collections/BufferPool.c	9
libfreerdp/utils/helpers.c	13
winpr/libwinpr/crt/unicode.c	2
winpr/libwinpr/crt/unicode_builtin.c	5
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/path/path.c	5
winpr/libwinpr/utils/winpr.c	5
winpr/libwinpr/path/shell.c	15
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/file/file.c	1
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	5
winpr/libwinpr/utils/config-readers.c	1
libfreerdp/codec/sse/rfx_sse2.h	1
libfreerdp/codec/sse/rfx_sse2.c	1
libfreerdp/codec/neon/rfx_neon.h	1
libfreerdp/codec/neon/rfx_neon.c	1
libfreerdp/codec/region.c	22
winpr/libwinpr/pool/work.c	4
winpr/libwinpr/pool/pool.c	5
winpr/libwinpr/utils/collections/Queue.c	12
winpr/libwinpr/crt/buffer.c	1
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
winpr/libwinpr/utils/collections/CountdownEvent.c	5
winpr/libwinpr/utils/collections/ArrayList.c	14
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/codec/rfx_decode.c	2
libfreerdp/codec/rfx_differential.h	1
libfreerdp/codec/progressive.c	43
winpr/libwinpr/utils/collections/HashTable.c	16
libfreerdp/codec/interleaved.c	16
winpr/libwinpr/crypto/rand.c	1
libfreerdp/codec/include/bitmap.h	9
libfreerdp/codec/planar.c	16

Fuzzer: TestFuzzCommonAssistanceParseFileBuffer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	231	35.8%
gold	[1:9]	68	10.5%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.15%
lawngreen	50+	345	53.4%
All colors	645	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
43	449	winpr_openssl_get_evp_cipher	call site: 00449	EVP_get_cipherbyname
34	173	WLog_ConsoleAppender_New	call site: 00173	WLog_FileAppender_New
16	119	NtCurrentTeb	call site: 00119	GetEnvironmentVariableA
15	36	EnterCriticalSection	call site: 00036	winpr_log_backtrace_ex
15	53	WLog_Print_dbg_tag	call site: 00053	WLog_PrintTextMessage
14	217	WLog_ParseFilters	call site: 00217	WLog_AddStringLogFilters_int
7	77	EnterCriticalSection	call site: 00077	log_recursion
7	161	WLog_InitializeRoot	call site: 00161	GetEnvironmentVariableA
6	17	WLog_IsLevelActive	call site: 00017	WLog_GetFilterLogLevel
5	88	InterlockedDecrement	call site: 00088	UnWaitCriticalSection
5	248	winpr_InitializeSSL	call site: 00248	WLog_Print_dbg_tag
4	72	GetCurrentThreadId	call site: 00072	WaitForCriticalSection

Runtime coverage analysis

Covered functions

149

Functions that are reachable but not covered

99

Reachable functions

233

Percentage of reachable functions covered

57.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/common/test/TestFuzzCommonAssistanceParseFileBuffer.c	2
libfreerdp/common/assistance.c	33
winpr/libwinpr/utils/ssl.c	5
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/include/winpr/wlog.h	1
winpr/libwinpr/crt/string.c	6
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	5
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/utils/collections/ArrayList.c	9
winpr/libwinpr/utils/print.c	2
winpr/libwinpr/crt/unicode.c	7
winpr/libwinpr/crt/unicode_builtin.c	8
winpr/libwinpr/crypto/hash.c	9
winpr/libwinpr/crypto/cipher.c	9
winpr/include/winpr/endian.h	2

Fuzzer: TestFuzzSmartcardOperations

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	530	35.0%
gold	[1:9]	171	11.3%
yellow	[10:29]	222	14.6%
greenyellow	[30:49]	135	8.92%
lawngreen	50+	455	30.0%
All colors	1513	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
47	685	smartcard_trace_locate_cards_a_call	call site: 00685	smartcard_msz_dump
34	172	WLog_ConsoleAppender_New	call site: 00172	WLog_FileAppender_New
31	498	smartcard_trace_list_readers_call	call site: 00498	smartcard_convert_string_list
23	1097	smartcard_trace_transmit_call	call site: 01097	smartcard_log_context
22	773	smartcard_trace_locate_cards_w_call	call site: 00773	dump_reader_states_w
18	405	smartcard_trace_context_call	call site: 00405	smartcard_log_context
18	568	smartcard_trace_context_and_string_call_w	call site: 00568	ConvertWCharToUtf8Alloc
16	95	NtCurrentTeb	call site: 00095	GetEnvironmentVariableA
15	1332	smartcard_trace_read_cache_w_call	call site: 01332	ConvertWCharToUtf8
14	216	WLog_ParseFilters	call site: 00216	WLog_AddStringLogFilters_int
14	1299	smartcard_trace_read_cache_a_call	call site: 01299	smartcard_log_context
14	1404	smartcard_trace_write_cache_w_call	call site: 01404	ConvertWCharToUtf8

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

92

Reachable functions

307

Percentage of reachable functions covered

70.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/utils/test/TestFuzzSmartcardOperations.c	1
winpr/libwinpr/utils/stream.c	9
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/string.c	6
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
libfreerdp/utils/smartcard_operations.c	45
winpr/include/winpr/stream.h	11
winpr/include/winpr/endian.h	4
libfreerdp/utils/rdpdr_utils.c	3
libfreerdp/utils/smartcard_pack.c	93
winpr/libwinpr/smartcard/smartcard.c	7
winpr/libwinpr/crt/unicode.c	6
winpr/libwinpr/crt/unicode_builtin.c	4
winpr/libwinpr/utils/print.c	2

Fuzzer: TestFuzzImage

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	154	29.5%
gold	[1:9]	92	17.6%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	2	0.38%
lawngreen	50+	273	52.2%
All colors	522	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	176	WLog_ConsoleAppender_New	call site: 00176	WLog_FileAppender_New
16	99	NtCurrentTeb	call site: 00099	GetEnvironmentVariableA
14	220	WLog_ParseFilters	call site: 00220	WLog_AddStringLogFilters_int
12	508	winpr_bitmap_write_buffer	call site: 00508	winpr_convert_to_jpeg
7	150	winpr_backtrace_free	call site: 00150	log_recursion
7	164	WLog_InitializeRoot	call site: 00164	GetEnvironmentVariableA
6	14	WLog_IsLevelActive	call site: 00014	WLog_GetFilterLogLevel
6	397	Stream_New	call site: 00397	winpr_int_assert
5	71	InterlockedDecrement	call site: 00071	UnWaitCriticalSection
4	44	unwind_backtrace_callback	call site: 00044	WLog_Print_dbg_tag
4	59	GetCurrentThreadId	call site: 00059	WaitForCriticalSection
4	135	WLog_AddChild	call site: 00135	WLog_Free

Runtime coverage analysis

Covered functions

124

Functions that are reachable but not covered

65

Reachable functions

174

Percentage of reachable functions covered

62.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
winpr/libwinpr/utils/test/TestFuzzImage.c	1
winpr/libwinpr/utils/image.c	17
winpr/libwinpr/utils/stream.c	16
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/string.c	2
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/include/winpr/stream.h	16
winpr/include/winpr/endian.h	8

Fuzzer: TestFuzzCommonAssistanceBinToHexString

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	100.%
All colors	4	100

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

0

Reachable functions

4

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/common/test/TestFuzzCommonAssistanceBinToHexString.c	1
libfreerdp/common/assistance.c	1
winpr/libwinpr/utils/print.c	2

Fuzzer: TestFuzzCryptoCertificateDataSetPEM

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	174	44.1%
gold	[1:9]	72	18.2%
yellow	[10:29]	10	2.53%
greenyellow	[30:49]	3	0.76%
lawngreen	50+	135	34.2%
All colors	394	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	178	WLog_ConsoleAppender_New	call site: 00178	WLog_FileAppender_New
16	123	NtCurrentTeb	call site: 00123	GetEnvironmentVariableA
15	40	EnterCriticalSection	call site: 00040	winpr_log_backtrace_ex
15	57	WLog_Print_dbg_tag	call site: 00057	WLog_PrintTextMessage
14	222	WLog_ParseFilters	call site: 00222	WLog_AddStringLogFilters_int
7	81	EnterCriticalSection	call site: 00081	log_recursion
7	166	WLog_InitializeRoot	call site: 00166	GetEnvironmentVariableA
6	21	WLog_IsLevelActive	call site: 00021	WLog_GetFilterLogLevel
5	92	InterlockedDecrement	call site: 00092	UnWaitCriticalSection
4	76	GetCurrentThreadId	call site: 00076	WaitForCriticalSection
4	159	WLog_AddChild	call site: 00159	WLog_Free
4	238	winpr_atexit	call site: 00238	WLog_Print_dbg_tag

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

111

Reachable functions

192

Percentage of reachable functions covered

42.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/core/test/TestFuzzCryptoCertificateDataSetPEM.c	1
libfreerdp/crypto/certificate_data.c	7
libfreerdp/crypto/certificate.c	18
libfreerdp/crypto/x509_utils.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	2
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	5
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	1
winpr/libwinpr/error/error.c	1
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	1
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
/usr/include/openssl/x509.h	6
libfreerdp/crypto/cert_common.c	3
libfreerdp/crypto/crypto.c	1
libfreerdp/crypto/opensslcompat.h	1

Fuzzer: TestFuzzServer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8046	82.0%
gold	[1:9]	280	2.85%
yellow	[10:29]	605	6.16%
greenyellow	[30:49]	371	3.78%
lawngreen	50+	505	5.14%
All colors	9807	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
6006	3740	transport_set_blocking_mode	call site: 03740	peer_recv_handle_licensing
309	2036	WINPR_JSON_ParseFromFile	call site: 02036	freerdp_settings_apply_from_json
238	2354	freerdp_certificate_new_from	call site: 02354	device_array_from_json
84	1752	freerdp_settings_set_string_	call site: 01752	WLog_Print_dbg_tag
61	696	freerdp_settings_get_uint32	call site: 00696	freerdp_settings_get_uint32
59	1937	reg_open	call site: 01937	reg_load
51	591	strtok_s	call site: 00591	IniFile_Load
51	1612	map_iana_id	call site: 01612	map_iana_id
46	544	WTSRegisterWtsApiFunctionTable	call site: 00544	InitializeWtsApiStubs_FreeRDS
46	3692	transport_get_context	call site: 03692	peer_recv_callback_internal
43	1109	cert_info_clone	call site: 01109	update_x509_from_info
43	9758	freerdp_certificate_new_from_file	call site: 09758	freerdp_settings_set_pointer_len

Runtime coverage analysis

Covered functions

541

Functions that are reachable but not covered

1408

Reachable functions

1889

Percentage of reachable functions covered

25.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/core/test/TestFuzzServer.c	2
libfreerdp/core/test/TestFuzzServerCerts.h	3
winpr/libwinpr/path/shell.c	21
winpr/libwinpr/environment/environment.c	3
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/crt/string.c	15
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	12
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	25
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/path/path.c	6
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/tools/makecert/makecert.c	17
winpr/libwinpr/utils/cmdline.c	5
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/file/file.c	2
winpr/libwinpr/crypto/rand.c	2
winpr/libwinpr/utils/print.c	5
winpr/libwinpr/crt/memory.c	2
libfreerdp/core/channels.c	2
winpr/libwinpr/wtsapi/wtsapi.c	7
winpr/libwinpr/library/library.c	4
winpr/libwinpr/utils/ini.c	23
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/ssl.c	6
libfreerdp/core/peer.c	17
libfreerdp/core/tcp.c	1
libfreerdp/core/settings.c	25
libfreerdp/common/settings.c	78
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
libfreerdp/crypto/certificate.c	40
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	8
libfreerdp/crypto/privatekey.c	13
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/streamdump.c	2
libfreerdp/core/metrics.c	2
libfreerdp/core/rdp.c	55
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	11
winpr/libwinpr/crt/unicode_builtin.c	8
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/rpc/rpc.c	3
libfreerdp/core/utils.c	10
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	24
libfreerdp/crypto/crypto.c	8
libfreerdp/core/transport.c	23
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/utils/stream.c	27
winpr/include/winpr/stream.h	41
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	58
libfreerdp/core/smartcardlogon.c	16
winpr/libwinpr/sspi/sspi_winpr.c	18
libfreerdp/core/credssp_auth.c	30
winpr/libwinpr/sspi/sspi.c	9
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	2
libfreerdp/core/nego.c	18
libfreerdp/core/mcs.c	20
libfreerdp/core/license.c	72
libfreerdp/core/fastpath.c	15
libfreerdp/core/input.c	10
winpr/libwinpr/utils/collections/MessageQueue.c	5
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	6
libfreerdp/core/update.h	3
libfreerdp/core/redirection.c	5
libfreerdp/core/autodetect.c	21
libfreerdp/core/heartbeat.c	3
libfreerdp/core/multitransport.c	6
libfreerdp/codec/bulk.c	2
libfreerdp/codec/mppc.c	3
winpr/libwinpr/utils/collections/BitStream.c	2
libfreerdp/codec/ncrush.c	4
libfreerdp/codec/xcrush.c	3
winpr/libwinpr/utils/collections/PubSub.c	6
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	15
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	26
winpr/libwinpr/crypto/cipher.c	11
libfreerdp/core/input.h	1
winpr/libwinpr/crypto/hash.c	16
libfreerdp/core/connection.c	21
include/freerdp/event.h	3
libfreerdp/core/tpkt.c	4
winpr/include/winpr/endian.h	17
libfreerdp/core/tpdu.c	7
libfreerdp/core/rdstls.c	41
winpr/libwinpr/nt/ntstatus.c	3
libfreerdp/core/freerdp.c	5
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	2
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/crypto/tls.c	2
winpr/libwinpr/utils/config-readers.c	1
winpr/libwinpr/sspi/Schannel/schannel.c	1
winpr/libwinpr/sspi/Kerberos/kerberos.c	1
winpr/libwinpr/sspi/NTLM/ntlm.c	1
winpr/libwinpr/sspi/CredSSP/credssp.c	1
winpr/libwinpr/sspi/Negotiate/negotiate.c	1
winpr/include/winpr/asn1.h	1
winpr/libwinpr/utils/asn1/asn1.c	43
/usr/include/openssl/x509v3.h	3
winpr/libwinpr/ncrypt/ncrypt.c	14
winpr/libwinpr/ncrypt/ncrypt_pkcs11.c	14
winpr/libwinpr/smartcard/smartcard.c	6
winpr/libwinpr/smartcard/smartcard_pcsc.c	2
/usr/include/openssl/asn1.h	3
winpr/libwinpr/utils/sam.c	11
libfreerdp/crypto/ber.c	17
libfreerdp/core/gcc.c	31
libfreerdp/crypto/per.c	19
libfreerdp/utils/string.c	1
libfreerdp/core/state.c	4
libfreerdp/core/info.c	7
libfreerdp/core/timezone.c	2
libfreerdp/core/activation.c	14
libfreerdp/core/capabilities.c	99
libfreerdp/core/display.c	3
libfreerdp/core/server.c	3

Fuzzer: TestFuzzChannelRail

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1380	56.0%
gold	[1:9]	98	3.97%
yellow	[10:29]	12	0.48%
greenyellow	[30:49]	26	1.05%
lawngreen	50+	948	38.4%
All colors	2464	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
598	1425	WINPR_JSON_ParseFromFile	call site: 01425	freerdp_settings_apply_from_json
84	1081	freerdp_settings_set_string_	call site: 01081	WLog_Print_dbg_tag
66	1319	reg_open	call site: 01319	reg_load
59	376	freerdp_settings_get_uint32	call site: 00376	freerdp_settings_get_uint32
51	941	map_iana_id	call site: 00941	map_iana_id
33	1388	reg_unload	call site: 01388	settings_load_config
27	1053	update_string_	call site: 01053	update_string_
20	2026	settings_client_load_hkey_local_machine	call site: 02026	settings_reg_query_bool
19	182	WLog_Appender_New	call site: 00182	WLog_UdpAppender_New
18	2213	rail_recv_handshake_ex_order	call site: 02213	rail_read_handshake_ex_order
15	2060	settings_client_load_hkey_local_machine	call site: 02060	freerdp_settings_set_pointer_array
14	167	WLog_ConsoleAppender_New	call site: 00167	WLog_FileAppender_New

Runtime coverage analysis

Covered functions

286

Functions that are reachable but not covered

288

Reachable functions

558

Percentage of reachable functions covered

48.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
channels/rail/client/test/TestFuzzChannelRail.c	3
winpr/libwinpr/utils/wlog/wlog.c	27
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	8
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	1
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	1
libfreerdp/core/settings.c	15
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	6
winpr/libwinpr/crt/unicode_builtin.c	8
libfreerdp/common/settings.c	71
libfreerdp/crypto/certificate.c	12
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	3
libfreerdp/crypto/privatekey.c	8
libfreerdp/common/settings_getters.c	20
libfreerdp/common/settings_str.c	5
winpr/libwinpr/crt/memory.c	1
winpr/libwinpr/sysinfo/sysinfo.c	2
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	1
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	15
winpr/libwinpr/path/path.c	5
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
libfreerdp/core/utils.c	1
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	1
libfreerdp/crypto/opensslcompat.h	1
winpr/libwinpr/utils/stream.c	11
winpr/include/winpr/stream.h	10
channels/rail/client/rail_orders.c	31
channels/rail/rail_common.c	10
winpr/include/winpr/endian.h	4
channels/rail/client/rail_main.c	1
libfreerdp/core/window.c	2

Fuzzer: TestFuzzCommonAssistanceHexStringToBin

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	9	100.%
All colors	9	100

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

3

Reachable functions

7

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/common/test/TestFuzzCommonAssistanceHexStringToBin.c	1
libfreerdp/common/assistance.c	1
winpr/libwinpr/utils/print.c	2

Fuzzer: TestFuzzClientRdpFile

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3424	72.7%
gold	[1:9]	83	1.76%
yellow	[10:29]	35	0.74%
greenyellow	[30:49]	23	0.48%
lawngreen	50+	1139	24.2%
All colors	4704	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1853	2737	freerdp_set_connection_type_from_file	call site: 02737	parse_command_line
598	1646	WINPR_JSON_ParseFromFile	call site: 01646	freerdp_settings_apply_from_json
154	2560	freerdp_client_populate_settings_from_rdp_file_unchecked	call site: 02560	freerdp_client_settings_parse_command_line
106	4593	winpr_GetUnixTimeNS	call site: 04593	freerdp_client_settings_post_process
84	1304	freerdp_settings_set_string_	call site: 01304	WLog_Print_dbg_tag
65	1542	reg_open	call site: 01542	reg_load
55	625	freerdp_settings_get_uint32	call site: 00625	freerdp_settings_get_uint32
51	1186	map_iana_id	call site: 01186	map_iana_id
34	177	WLog_ConsoleAppender_New	call site: 00177	WLog_FileAppender_New
32	1610	reg_unload	call site: 01610	settings_load_config
27	1276	update_string_	call site: 01276	update_string_
20	2247	settings_client_load_hkey_local_machine	call site: 02247	settings_reg_query_bool

Runtime coverage analysis

Covered functions

255

Functions that are reachable but not covered

599

Reachable functions

839

Percentage of reachable functions covered

28.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
client/common/test/TestFuzzClientRdpFile.c	2
client/common/file.c	25
libfreerdp/common/settings.c	86
winpr/libwinpr/crt/string.c	10
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/wlog.c	29
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	8
winpr/libwinpr/utils/debug.c	5
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	4
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/crt/unicode.c	9
winpr/libwinpr/crt/unicode_builtin.c	8
winpr/libwinpr/crt/memory.c	2
libfreerdp/core/settings.c	16
libfreerdp/utils/helpers.c	14
libfreerdp/crypto/certificate.c	12
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	3
libfreerdp/crypto/privatekey.c	8
libfreerdp/common/settings_getters.c	22
libfreerdp/common/settings_str.c	6
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	28
winpr/libwinpr/file/file.c	1
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	18
winpr/libwinpr/path/path.c	5
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
libfreerdp/core/utils.c	2
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	2
libfreerdp/crypto/opensslcompat.h	1
client/common/cmdline.c	97
winpr/libwinpr/utils/cmdline.c	13
client/common/client.c	5
libfreerdp/common/assistance.c	36
winpr/libwinpr/utils/ssl.c	5
winpr/libwinpr/utils/collections/ArrayList.c	11
winpr/libwinpr/utils/print.c	2
winpr/libwinpr/crypto/hash.c	9
winpr/libwinpr/crypto/cipher.c	9
winpr/include/winpr/endian.h	2
libfreerdp/crypto/base64.c	4
libfreerdp/utils/string.c	1
libfreerdp/locale/keyboard_layout.c	8
libfreerdp/locale/locale.c	2
libfreerdp/core/proxy.c	2
libfreerdp/utils/passphrase.c	10
libfreerdp/core/freerdp.c	3
winpr/libwinpr/synch/wait.c	4
winpr/libwinpr/synch/../handle/handle.h	3
winpr/libwinpr/thread/apc.c	4
winpr/libwinpr/synch/pollset.c	6

Fuzzer: TestFuzzCoreServer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7477	66.0%
gold	[1:9]	330	2.91%
yellow	[10:29]	152	1.34%
greenyellow	[30:49]	129	1.14%
lawngreen	50+	3224	28.5%
All colors	11312	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1068	9753	update_recv_altsec_window_order	call site: 09753	update_recv_primary_order
556	1680	WINPR_JSON_ParseFromFile	call site: 01680	freerdp_settings_apply_from_json
517	8921	fastpath_recv_input_event	call site: 08921	peer_recv_handle_licensing
381	4995	winpr_BinToHexString	call site: 04995	nla_client_setup_identity
344	7672	certificate_read_server_x509_certificate_chain	call site: 07672	license_recv
324	4499	Stream_Buffer	call site: 04499	nla_server_recv_credentials
232	7324	multitransport_recv_response	call site: 07324	license_recv
170	4824	Stream_Length	call site: 04824	nla_client_authenticate
158	4187	nla_sec_buffer_alloc_from_data	call site: 04187	credssp_auth_init
145	6321	per_write_choice	call site: 06321	mcs_write_connect_response
140	8163	stream_read_i16_le	call site: 08163	rdp_server_accept_confirm_active
139	9604	update_recv_order	call site: 09604	update_recv_altsec_order

Runtime coverage analysis

Covered functions

936

Functions that are reachable but not covered

1154

Reachable functions

2000

Percentage of reachable functions covered

42.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/core/test/TestFuzzCoreServer.c	2
libfreerdp/core/peer.c	15
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/string.c	15
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	12
winpr/libwinpr/utils/unwind/debug.c	6
winpr/include/winpr/wlog.h	1
winpr/libwinpr/thread/thread.c	25
winpr/libwinpr/environment/environment.c	3
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
libfreerdp/core/settings.c	25
libfreerdp/common/settings.c	78
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
winpr/libwinpr/crt/memory.c	2
libfreerdp/crypto/certificate.c	39
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	8
libfreerdp/crypto/privatekey.c	11
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/streamdump.c	2
libfreerdp/core/metrics.c	3
libfreerdp/core/rdp.c	55
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	11
winpr/libwinpr/crt/unicode_builtin.c	8
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	2
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	21
winpr/libwinpr/path/path.c	6
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
libfreerdp/core/utils.c	10
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	24
libfreerdp/crypto/crypto.c	8
libfreerdp/core/transport.c	23
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/utils/stream.c	27
winpr/include/winpr/stream.h	43
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	58
libfreerdp/core/smartcardlogon.c	16
winpr/libwinpr/sspi/sspi_winpr.c	18
libfreerdp/core/credssp_auth.c	30
winpr/libwinpr/sspi/sspi.c	9
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	2
libfreerdp/core/nego.c	18
libfreerdp/core/mcs.c	21
libfreerdp/core/license.c	72
libfreerdp/core/fastpath.c	24
libfreerdp/core/input.c	10
winpr/libwinpr/utils/collections/MessageQueue.c	4
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	25
libfreerdp/core/update.h	4
libfreerdp/core/redirection.c	5
libfreerdp/core/autodetect.c	21
libfreerdp/core/heartbeat.c	3
libfreerdp/core/multitransport.c	6
libfreerdp/codec/bulk.c	5
libfreerdp/codec/mppc.c	5
winpr/libwinpr/utils/collections/BitStream.c	3
libfreerdp/codec/ncrush.c	8
libfreerdp/codec/xcrush.c	7
winpr/libwinpr/utils/collections/PubSub.c	6
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	15
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	26
winpr/libwinpr/crypto/cipher.c	11
libfreerdp/core/input.h	1
winpr/libwinpr/utils/ssl.c	6
winpr/libwinpr/crypto/hash.c	16
libfreerdp/core/connection.c	24
include/freerdp/event.h	5
libfreerdp/core/tpkt.c	4
winpr/include/winpr/endian.h	19
libfreerdp/core/tpdu.c	7
libfreerdp/core/rdstls.c	41
winpr/libwinpr/nt/ntstatus.c	3
libfreerdp/core/freerdp.c	9
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	2
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/crypto/tls.c	2
winpr/libwinpr/utils/config-readers.c	1
winpr/libwinpr/library/library.c	4
winpr/libwinpr/sspi/Schannel/schannel.c	1
winpr/libwinpr/sspi/Kerberos/kerberos.c	1
winpr/libwinpr/sspi/NTLM/ntlm.c	1
winpr/libwinpr/sspi/CredSSP/credssp.c	1
winpr/libwinpr/sspi/Negotiate/negotiate.c	1
winpr/include/winpr/asn1.h	1
winpr/libwinpr/utils/asn1/asn1.c	43
/usr/include/openssl/x509v3.h	3
winpr/libwinpr/utils/print.c	5
winpr/libwinpr/ncrypt/ncrypt.c	14
winpr/libwinpr/ncrypt/ncrypt_pkcs11.c	14
winpr/libwinpr/smartcard/smartcard.c	6
winpr/libwinpr/smartcard/smartcard_pcsc.c	2
/usr/include/openssl/asn1.h	3
winpr/libwinpr/utils/sam.c	11
libfreerdp/crypto/ber.c	18
libfreerdp/core/gcc.c	39
libfreerdp/crypto/per.c	20
libfreerdp/utils/string.c	1
libfreerdp/core/state.c	4
libfreerdp/core/info.c	7
libfreerdp/core/timezone.c	2
libfreerdp/core/activation.c	16
libfreerdp/core/capabilities.c	101
libfreerdp/core/channels.c	1
libfreerdp/core/display.c	3
winpr/include/winpr/bitstream.h	3
libfreerdp/core/orders.c	85
libfreerdp/core/window.c	25
libfreerdp/cache/bitmap.c	5
libfreerdp/cache/cache.c	1
libfreerdp/cache/glyph.c	2
libfreerdp/cache/brush.c	1
libfreerdp/gdi/gdi.c	2
libfreerdp/cache/palette.c	1
libfreerdp/core/surface.c	6
libfreerdp/utils/pcap.c	4
libfreerdp/cache/pointer.c	6

Fuzzer: TestFuzzCoreClient

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6105	57.7%
gold	[1:9]	324	3.06%
yellow	[10:29]	284	2.68%
greenyellow	[30:49]	156	1.47%
lawngreen	50+	3708	35.0%
All colors	10577	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
761	9369	rdp_recv_deactivate_all	call site: 09369	rdp_handle_sc_flags
568	1444	WINPR_JSON_ParseFromFile	call site: 01444	freerdp_settings_apply_from_json
384	7717	multitransport_recv_response	call site: 07717	license_recv
287	3740	stream_read_i32_le	call site: 03740	dump_window_state_order
245	5521	winpr_Data_Write_UINT16_BE	call site: 05521	nla_client_recv_pub_key_auth
196	8102	Stream_Seek_UINT32	call site: 08102	rdp_client_connect_license
172	7028	rdp_security_flag_string	call site: 07028	rdp_send_client_info
165	7255	rdp_get_client_address_max_size	call site: 07255	rdp_client_connect_auto_detect
145	6321	per_write_choice	call site: 06321	mcs_write_connect_initial
112	5158	Stream_Length	call site: 05158	security_decrypt
111	4575	Stream_ConstPointer	call site: 04575	update_read_polygon_cb_order
108	6886	mcs_write_domain_mcspdu_header	call site: 06886	rdp_client_skip_mcs_channel_join

Runtime coverage analysis

Covered functions

950

Functions that are reachable but not covered

931

Reachable functions

1846

Percentage of reachable functions covered

49.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/core/test/TestFuzzCoreClient.c	2
client/common/client.c	2
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	12
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	25
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/synch/sleep.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
libfreerdp/core/freerdp.c	14
libfreerdp/core/utils.c	8
libfreerdp/core/metrics.c	3
libfreerdp/core/rdp.c	60
libfreerdp/core/settings.c	21
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	8
winpr/libwinpr/crt/unicode_builtin.c	8
libfreerdp/common/settings.c	77
libfreerdp/crypto/certificate.c	27
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	8
libfreerdp/crypto/privatekey.c	9
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
winpr/libwinpr/crt/memory.c	2
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	2
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	21
winpr/libwinpr/path/path.c	6
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	4
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/transport.c	13
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/utils/stream.c	26
winpr/include/winpr/stream.h	42
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	33
libfreerdp/core/smartcardlogon.c	3
winpr/libwinpr/sspi/sspi_winpr.c	2
libfreerdp/core/credssp_auth.c	13
winpr/libwinpr/sspi/sspi.c	6
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	4
libfreerdp/core/nego.c	16
libfreerdp/core/mcs.c	21
libfreerdp/core/license.c	64
libfreerdp/core/fastpath.c	24
libfreerdp/core/input.c	3
winpr/libwinpr/utils/collections/MessageQueue.c	5
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	27
libfreerdp/core/update.h	4
libfreerdp/core/redirection.c	14
libfreerdp/core/autodetect.c	17
libfreerdp/core/heartbeat.c	3
libfreerdp/core/multitransport.c	4
libfreerdp/codec/bulk.c	5
libfreerdp/codec/mppc.c	5
winpr/libwinpr/utils/collections/BitStream.c	3
libfreerdp/codec/ncrush.c	8
libfreerdp/codec/xcrush.c	7
winpr/libwinpr/utils/collections/PubSub.c	7
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	15
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	26
winpr/libwinpr/crypto/cipher.c	9
libfreerdp/core/input.h	1
libfreerdp/core/graphics.c	3
libfreerdp/core/client.c	3
winpr/libwinpr/utils/collections/HashTable.c	6
libfreerdp/core/streamdump.c	2
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	2
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/core/codecs.c	3
libfreerdp/codec/rfx.c	6
winpr/libwinpr/crt/alignment.c	9
winpr/libwinpr/utils/collections/BufferPool.c	6
winpr/libwinpr/utils/collections/ObjectPool.c	6
libfreerdp/codec/nsc.c	4
libfreerdp/codec/clear.c	4
libfreerdp/codec/progressive.c	2
libfreerdp/codec/planar.c	2
libfreerdp/codec/interleaved.c	2
libfreerdp/common/addin.c	1
channels/client/addin.c	2
winpr/include/winpr/endian.h	19
winpr/include/winpr/bitstream.h	3
libfreerdp/core/orders.c	85
libfreerdp/core/connection.c	22
libfreerdp/core/window.c	25
libfreerdp/cache/bitmap.c	10
libfreerdp/cache/cache.c	4
libfreerdp/cache/glyph.c	4
libfreerdp/cache/brush.c	3
libfreerdp/gdi/gdi.c	2
libfreerdp/cache/palette.c	3
libfreerdp/core/surface.c	6
libfreerdp/utils/pcap.c	4
libfreerdp/cache/pointer.c	12
libfreerdp/crypto/per.c	22
winpr/libwinpr/crypto/hash.c	16
include/freerdp/event.h	5
winpr/include/winpr/asn1.h	1
winpr/libwinpr/utils/asn1/asn1.c	37
winpr/libwinpr/nt/ntstatus.c	2
libfreerdp/core/tpkt.c	4
libfreerdp/core/tpdu.c	7
libfreerdp/core/state.c	3
libfreerdp/core/gcc.c	43
libfreerdp/utils/string.c	2
libfreerdp/crypto/ber.c	18
winpr/libwinpr/utils/print.c	4
libfreerdp/core/info.c	23
libfreerdp/core/timezone.c	4
libfreerdp/core/capabilities.c	112
libfreerdp/core/activation.c	17
libfreerdp/crypto/base64.c	7
libfreerdp/core/channels.c	1
libfreerdp/cache/persistent.c	16
libfreerdp/cache/offscreen.c	2
libfreerdp/cache/nine_grid.c	2

Fuzzer: TestFuzzChannelRdpgfx

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1750	52.3%
gold	[1:9]	35	1.04%
yellow	[10:29]	5	0.14%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1556	46.5%
All colors	3346	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
568	1446	WINPR_JSON_ParseFromFile	call site: 01446	freerdp_settings_apply_from_json
104	3166	freerdp_context_free	call site: 03166	codecs_free_int
84	1102	freerdp_settings_set_string_	call site: 01102	WLog_Print_dbg_tag
66	1340	reg_open	call site: 01340	reg_load
59	397	freerdp_settings_get_uint32	call site: 00397	freerdp_settings_get_uint32
51	962	map_iana_id	call site: 00962	map_iana_id
39	2187	cert_info_clone	call site: 02187	update_x509_from_info
37	2464	transport_free	call site: 02464	smartcardCertInfo_Free
33	1409	reg_unload	call site: 01409	settings_load_config
28	2015	freerdp_settings_set_uint64	call site: 02015	settings_json_string
27	1074	update_string_	call site: 01074	update_string_
25	3132	freerdp_context_new_ex	call site: 03132	freerdp_set_last_error_ex

Runtime coverage analysis

Covered functions

580

Functions that are reachable but not covered

405

Reachable functions

850

Percentage of reachable functions covered

52.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
channels/rdpgfx/client/test/TestFuzzChannelRdpgfx.c	2
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	7
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	25
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	2
client/common/client.c	2
libfreerdp/core/freerdp.c	9
libfreerdp/core/utils.c	3
libfreerdp/core/metrics.c	2
libfreerdp/core/rdp.c	8
libfreerdp/core/settings.c	20
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	6
winpr/libwinpr/crt/unicode_builtin.c	8
libfreerdp/common/settings.c	73
libfreerdp/crypto/certificate.c	17
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	5
libfreerdp/crypto/privatekey.c	9
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
winpr/libwinpr/crt/memory.c	2
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	1
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	16
winpr/libwinpr/path/path.c	5
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	1
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/transport.c	5
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/utils/stream.c	11
winpr/include/winpr/stream.h	10
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	2
libfreerdp/core/smartcardlogon.c	3
winpr/libwinpr/sspi/sspi_winpr.c	1
libfreerdp/core/credssp_auth.c	2
winpr/libwinpr/sspi/sspi.c	3
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	2
libfreerdp/core/nego.c	4
libfreerdp/core/mcs.c	3
libfreerdp/core/license.c	11
libfreerdp/core/fastpath.c	2
libfreerdp/core/input.c	2
winpr/libwinpr/utils/collections/MessageQueue.c	5
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	3
libfreerdp/core/update.h	3
libfreerdp/core/redirection.c	5
libfreerdp/core/autodetect.c	2
libfreerdp/core/heartbeat.c	2
libfreerdp/core/multitransport.c	2
libfreerdp/codec/bulk.c	2
libfreerdp/codec/mppc.c	3
winpr/libwinpr/utils/collections/BitStream.c	2
libfreerdp/codec/ncrush.c	4
libfreerdp/codec/xcrush.c	3
winpr/libwinpr/utils/collections/PubSub.c	5
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	15
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	2
winpr/libwinpr/crypto/cipher.c	2
libfreerdp/core/input.h	1
libfreerdp/core/graphics.c	2
libfreerdp/core/client.c	3
winpr/libwinpr/utils/collections/HashTable.c	6
libfreerdp/core/streamdump.c	2
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	1
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/core/codecs.c	2
libfreerdp/codec/rfx.c	5
winpr/libwinpr/crt/alignment.c	8
winpr/libwinpr/utils/collections/BufferPool.c	6
winpr/libwinpr/utils/collections/ObjectPool.c	6
libfreerdp/codec/nsc.c	3
libfreerdp/codec/clear.c	3
libfreerdp/codec/progressive.c	1
libfreerdp/codec/planar.c	1
libfreerdp/codec/interleaved.c	1
libfreerdp/common/addin.c	1
channels/client/addin.c	2
winpr/include/winpr/endian.h	3

Fuzzer: TestFuzzCoreGateway

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2706	51.6%
gold	[1:9]	74	1.41%
yellow	[10:29]	45	0.85%
greenyellow	[30:49]	43	0.82%
lawngreen	50+	2368	45.2%
All colors	5236	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
567	1972	WINPR_JSON_ParseFromFile	call site: 01972	freerdp_settings_apply_from_json
249	4666	tsg_recv_pdu	call site: 04666	tsg_proxy_reauth
156	4320	TsProxyAuthorizeTunnelReadResponse	call site: 04320	tsg_redirect_apply
102	3651	freerdp_context_free	call site: 03651	codecs_free_int
84	1633	freerdp_settings_set_string_	call site: 01633	WLog_Print_dbg_tag
80	3802	_strnicmp	call site: 03802	proxy_parse_uri
76	4214	Stream_Write_UINT16_unchecked	call site: 04214	rpc_client_write_call
73	4478	HashTable_Foreach	call site: 04478	apply_gw_policy
72	4593	tsg_recv_pdu	call site: 04593	TsProxySetupReceivePipeWriteRequest
59	934	freerdp_settings_get_uint32	call site: 00934	freerdp_settings_get_uint32
54	4157	tsg_transition_to_state	call site: 04157	TsProxyAuthorizeTunnelWriteRequest
51	1493	map_iana_id	call site: 01493	map_iana_id

Runtime coverage analysis

Covered functions

703

Functions that are reachable but not covered

577

Reachable functions

1246

Percentage of reachable functions covered

53.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfreerdp/core/test/TestFuzzCoreGateway.c	5
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	13
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	26
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	3
winpr/libwinpr/utils/stream.c	22
winpr/include/winpr/stream.h	30
winpr/include/winpr/endian.h	11
libfreerdp/core/gateway/rts.c	59
libfreerdp/core/gateway/rpc.c	8
winpr/libwinpr/nt/ntstatus.c	3
libfreerdp/core/gateway/rts_signature.c	5
libfreerdp/core/gateway/websocket.c	14
winpr/libwinpr/crypto/rand.c	2
libfreerdp/core/gateway/../tcp.h	3
client/common/client.c	2
libfreerdp/core/freerdp.c	11
libfreerdp/core/utils.c	14
libfreerdp/core/metrics.c	2
libfreerdp/core/rdp.c	8
libfreerdp/core/settings.c	20
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	6
winpr/libwinpr/crt/unicode_builtin.c	8
libfreerdp/common/settings.c	76
libfreerdp/crypto/certificate.c	17
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	5
libfreerdp/crypto/privatekey.c	9
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
winpr/libwinpr/crt/memory.c	2
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	1
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	16
winpr/libwinpr/path/path.c	5
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	1
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/transport.c	6
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	2
libfreerdp/core/smartcardlogon.c	3
winpr/libwinpr/sspi/sspi_winpr.c	1
libfreerdp/core/credssp_auth.c	8
winpr/libwinpr/sspi/sspi.c	6
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	2
libfreerdp/core/nego.c	4
libfreerdp/core/mcs.c	3
libfreerdp/core/license.c	11
libfreerdp/core/fastpath.c	2
libfreerdp/core/input.c	2
winpr/libwinpr/utils/collections/MessageQueue.c	10
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	3
libfreerdp/core/update.h	3
libfreerdp/core/redirection.c	5
libfreerdp/core/autodetect.c	2
libfreerdp/core/heartbeat.c	2
libfreerdp/core/multitransport.c	2
libfreerdp/codec/bulk.c	2
libfreerdp/codec/mppc.c	3
winpr/libwinpr/utils/collections/BitStream.c	2
libfreerdp/codec/ncrush.c	4
libfreerdp/codec/xcrush.c	3
winpr/libwinpr/utils/collections/PubSub.c	7
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	17
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	2
winpr/libwinpr/crypto/cipher.c	2
libfreerdp/core/input.h	1
libfreerdp/core/graphics.c	2
libfreerdp/core/client.c	14
winpr/libwinpr/utils/collections/HashTable.c	21
libfreerdp/core/streamdump.c	2
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	1
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/core/codecs.c	2
libfreerdp/codec/rfx.c	5
winpr/libwinpr/crt/alignment.c	8
winpr/libwinpr/utils/collections/BufferPool.c	6
winpr/libwinpr/utils/collections/ObjectPool.c	6
libfreerdp/codec/nsc.c	3
libfreerdp/codec/clear.c	3
libfreerdp/codec/progressive.c	1
libfreerdp/codec/planar.c	1
libfreerdp/codec/interleaved.c	1
libfreerdp/common/addin.c	1
channels/client/addin.c	2
libfreerdp/core/gateway/tsg.c	74
libfreerdp/core/gateway/rpc_client.c	11
libfreerdp/core/proxy.c	11
libfreerdp/core/tcp.c	2
libfreerdp/utils/ringbuffer.c	2
libfreerdp/core/gateway/http.c	27
winpr/libwinpr/utils/collections/ListDictionary.c	13
libfreerdp/crypto/tls.c	5
libfreerdp/crypto/certificate_store.c	1
libfreerdp/core/gateway/rpc_bind.c	1
libfreerdp/crypto/../core/tcp.h	3
winpr/libwinpr/utils/print.c	3
include/freerdp/event.h	3
libfreerdp/crypto/base64.c	4
winpr/libwinpr/crypto/hash.c	8

Fuzzer: TestFuzzDrdynvc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1733	52.1%
gold	[1:9]	35	1.05%
yellow	[10:29]	5	0.15%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1553	46.6%
All colors	3326	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
568	1446	WINPR_JSON_ParseFromFile	call site: 01446	freerdp_settings_apply_from_json
104	3166	freerdp_context_free	call site: 03166	codecs_free_int
84	1102	freerdp_settings_set_string_	call site: 01102	WLog_Print_dbg_tag
66	1340	reg_open	call site: 01340	reg_load
59	397	freerdp_settings_get_uint32	call site: 00397	freerdp_settings_get_uint32
51	962	map_iana_id	call site: 00962	map_iana_id
39	2187	cert_info_clone	call site: 02187	update_x509_from_info
37	2464	transport_free	call site: 02464	smartcardCertInfo_Free
33	1409	reg_unload	call site: 01409	settings_load_config
28	2015	freerdp_settings_set_uint64	call site: 02015	settings_json_string
27	1074	update_string_	call site: 01074	update_string_
25	3132	freerdp_context_new_ex	call site: 03132	freerdp_set_last_error_ex

Runtime coverage analysis

Covered functions

548

Functions that are reachable but not covered

398

Reachable functions

847

Percentage of reachable functions covered

53.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
channels/drdynvc/client/test/TestFuzzDrdynvc.c	2
winpr/libwinpr/utils/wlog/wlog.c	30
winpr/libwinpr/synch/init.c	1
winpr/libwinpr/interlocked/interlocked.c	3
winpr/libwinpr/crt/assert.c	1
winpr/libwinpr/crt/string.c	7
winpr/include/winpr/wlog.h	1
winpr/libwinpr/utils/wlog/Appender.c	5
winpr/libwinpr/synch/critical.c	9
winpr/libwinpr/utils/debug.c	6
winpr/libwinpr/utils/unwind/debug.c	6
winpr/libwinpr/thread/thread.c	25
winpr/libwinpr/environment/environment.c	2
winpr/libwinpr/error/error.c	2
winpr/libwinpr/nt/nt.c	3
winpr/libwinpr/utils/wlog/Layout.c	2
winpr/libwinpr/utils/wlog/ConsoleAppender.c	1
winpr/libwinpr/utils/wlog/FileAppender.c	3
winpr/libwinpr/utils/wlog/BinaryAppender.c	1
winpr/libwinpr/utils/wlog/CallbackAppender.c	1
winpr/libwinpr/utils/wlog/SyslogAppender.c	1
winpr/libwinpr/utils/wlog/UdpAppender.c	2
winpr/libwinpr/winsock/winsock.c	2
winpr/libwinpr/utils/atexit.c	1
winpr/libwinpr/synch/sleep.c	2
client/common/client.c	2
libfreerdp/core/freerdp.c	9
libfreerdp/core/utils.c	3
libfreerdp/core/metrics.c	2
libfreerdp/core/rdp.c	8
libfreerdp/core/settings.c	20
libfreerdp/utils/helpers.c	14
winpr/libwinpr/crt/unicode.c	6
winpr/libwinpr/crt/unicode_builtin.c	8
libfreerdp/common/settings.c	73
libfreerdp/crypto/certificate.c	17
/usr/include/openssl/x509.h	4
libfreerdp/crypto/cert_common.c	5
libfreerdp/crypto/privatekey.c	9
libfreerdp/common/settings_getters.c	25
libfreerdp/common/settings_str.c	6
winpr/libwinpr/crt/memory.c	2
winpr/libwinpr/sysinfo/sysinfo.c	5
winpr/libwinpr/timezone/timezone.c	27
winpr/libwinpr/file/file.c	1
winpr/libwinpr/timezone/TimeZoneNameMapUtils.c	12
winpr/libwinpr/timezone/TimeZoneIanaAbbrevMap.c	9
winpr/libwinpr/path/shell.c	16
winpr/libwinpr/path/path.c	5
winpr/libwinpr/path/include/PathCchAppend.h	1
winpr/include/winpr/error.h	1
winpr/libwinpr/rpc/rpc.c	3
winpr/libwinpr/crypto/rand.c	2
winpr/libwinpr/registry/registry.c	6
winpr/libwinpr/registry/registry_reg.c	16
winpr/libwinpr/utils/winpr.c	5
winpr/include/winpr/wtypes.h	2
winpr/libwinpr/utils/json/json.c	2
winpr/libwinpr/utils/json/json-c.c	15
libfreerdp/crypto/x509_utils.c	1
libfreerdp/crypto/crypto.c	1
libfreerdp/crypto/opensslcompat.h	1
libfreerdp/core/transport.c	5
winpr/libwinpr/utils/collections/StreamPool.c	20
winpr/libwinpr/utils/stream.c	10
winpr/include/winpr/stream.h	9
winpr/libwinpr/synch/event.c	9
winpr/libwinpr/synch/../handle/handle.h	4
winpr/libwinpr/handle/handle.c	2
libfreerdp/core/nla.c	2
libfreerdp/core/smartcardlogon.c	3
winpr/libwinpr/sspi/sspi_winpr.c	1
libfreerdp/core/credssp_auth.c	2
winpr/libwinpr/sspi/sspi.c	3
winpr/libwinpr/handle/../synch/../handle/handle.h	2
winpr/libwinpr/handle/nonehandle.c	1
libfreerdp/core/aad.c	2
libfreerdp/core/nego.c	4
libfreerdp/core/mcs.c	3
libfreerdp/core/license.c	11
libfreerdp/core/fastpath.c	2
libfreerdp/core/input.c	2
winpr/libwinpr/utils/collections/MessageQueue.c	5
winpr/libwinpr/crt/buffer.c	1
libfreerdp/core/update.c	3
libfreerdp/core/update.h	3
libfreerdp/core/redirection.c	5
libfreerdp/core/autodetect.c	2
libfreerdp/core/heartbeat.c	2
libfreerdp/core/multitransport.c	2
libfreerdp/codec/bulk.c	2
libfreerdp/codec/mppc.c	3
winpr/libwinpr/utils/collections/BitStream.c	2
libfreerdp/codec/ncrush.c	4
libfreerdp/codec/xcrush.c	3
winpr/libwinpr/utils/collections/PubSub.c	5
libfreerdp/core/timer.c	6
winpr/libwinpr/utils/collections/ArrayList.c	15
winpr/libwinpr/thread/apc.c	6
winpr/libwinpr/thread/../handle/handle.h	1
winpr/libwinpr/synch/wait.c	6
winpr/libwinpr/synch/pollset.c	7
libfreerdp/core/security.c	2
winpr/libwinpr/crypto/cipher.c	2
libfreerdp/core/input.h	1
libfreerdp/core/graphics.c	2
libfreerdp/core/client.c	3
winpr/libwinpr/utils/collections/HashTable.c	6
libfreerdp/core/streamdump.c	2
libfreerdp/core/errbase.c	1
libfreerdp/core/errinfo.c	1
libfreerdp/core/errconnect.c	1
libfreerdp/core/gateway/rpc_fault.c	1
libfreerdp/core/codecs.c	2
libfreerdp/codec/rfx.c	5
winpr/libwinpr/crt/alignment.c	8
winpr/libwinpr/utils/collections/BufferPool.c	6
winpr/libwinpr/utils/collections/ObjectPool.c	6
libfreerdp/codec/nsc.c	3
libfreerdp/codec/clear.c	3
libfreerdp/codec/progressive.c	1
libfreerdp/codec/planar.c	1
libfreerdp/codec/interleaved.c	1
libfreerdp/common/addin.c	1
channels/client/addin.c	2
winpr/include/winpr/endian.h	2