High level conclusions

Fuzzer ghostpdl/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc is blocked:

The runtime code coverage of ghostpdl/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc covers 9.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ghostpdl/brotli/c/fuzz/decode_fuzzer.c is blocked:

The runtime code coverage of ghostpdl/brotli/c/fuzz/decode_fuzzer.c covers 1.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ghostpdl/expat/fuzz/xml_parse_fuzzer.c is blocked:

The runtime code coverage of ghostpdl/expat/fuzz/xml_parse_fuzzer.c covers 1.785% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ghostpdl/expat/fuzz/xml_parsebuffer_fuzzer.c is blocked:

The runtime code coverage of ghostpdl/expat/fuzz/xml_parsebuffer_fuzzer.c covers 1.785% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 2.847% of cyclomatic complexity.

Fuzzers reach 2.979% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

809 / 27152

Cyclomatic complexity statically reachable by fuzzers

5199 / 182556

Runtime code coverage of functions

8467 / 27152

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: gstoraster_ps_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1656	69.6%
gold	[1:9]	4	0.16%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	0.25%
lawngreen	50+	710	29.8%
All colors	2376	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1368	gs_add_control_path_len	call site: 01368	handle_dash_c
101	1776	gs_findiodevice	call site: 01776	pjl_set_fs_download_state
98	2059	gs_add_outputfile_control_path	call site: 02059	pl_main_set_parsed_param
85	1685	gs_snprintf	call site: 01685	pjl_set
85	1968	gp_unlink	call site: 01968	pjl_parse_and_process_line
69	859	gdev_prn_allocate	call site: 00859	gx_saved_pages_list_print
50	2325	sfclose	call site: 02325	gsapi_exit
47	430	gs_lib_finit	call site: 00430	gsapi_init_with_args
43	2280	sreadbuf	call site: 02280	s_process_read_buf
40	1223	clist_close_writer_and_init_reader	call site: 01223	gx_output_saved_page
38	762	gx_default_size_buf_device	call site: 00762	set_planar
36	1535	gp_file_dealloc	call site: 01535	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

5379

Functions that are reachable but not covered

508

Reachable functions

931

Percentage of reachable functions covered

45.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gstoraster_ps_fuzzer.cc	3
gs_fuzzlib.h	9
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gstoraster_pdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1671	70.3%
gold	[1:9]	8	0.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	697	29.3%
All colors	2376	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1368	gs_add_control_path_len	call site: 01368	handle_dash_c
101	1776	gs_findiodevice	call site: 01776	pjl_set_fs_download_state
98	2059	gs_add_outputfile_control_path	call site: 02059	pl_main_set_parsed_param
86	1685	gs_snprintf	call site: 01685	pjl_set
85	1968	gp_unlink	call site: 01968	pjl_parse_and_process_line
69	859	gdev_prn_allocate	call site: 00859	gx_saved_pages_list_print
50	2325	sfclose	call site: 02325	gsapi_exit
47	430	gs_lib_finit	call site: 00430	gsapi_init_with_args
43	2280	sreadbuf	call site: 02280	s_process_read_buf
40	1223	clist_close_writer_and_init_reader	call site: 01223	gx_output_saved_page
38	762	gx_default_size_buf_device	call site: 00762	set_planar
36	1535	gp_file_dealloc	call site: 01535	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6070

Functions that are reachable but not covered

527

Reachable functions

931

Percentage of reachable functions covered

43.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gstoraster_pdf_fuzzer.cc	3
gs_fuzzlib.h	9
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gstoraster_fuzzer_all_colors

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1651	69.5%
gold	[1:9]	8	0.33%
yellow	[10:29]	2	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	714	30.0%
All colors	2375	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1367	gs_add_control_path_len	call site: 01367	handle_dash_c
101	1775	gs_findiodevice	call site: 01775	pjl_set_fs_download_state
98	2058	gs_add_outputfile_control_path	call site: 02058	pl_main_set_parsed_param
85	1684	gs_snprintf	call site: 01684	pjl_set
85	1967	gp_unlink	call site: 01967	pjl_parse_and_process_line
69	858	gdev_prn_allocate	call site: 00858	gx_saved_pages_list_print
50	2324	sfclose	call site: 02324	gsapi_exit
47	429	gs_lib_finit	call site: 00429	gsapi_init_with_args
43	2279	sreadbuf	call site: 02279	s_process_read_buf
40	1222	clist_close_writer_and_init_reader	call site: 01222	gx_output_saved_page
38	761	gx_default_size_buf_device	call site: 00761	set_planar
36	1534	gp_file_dealloc	call site: 01534	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

5775

Functions that are reachable but not covered

505

Reachable functions

930

Percentage of reachable functions covered

45.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gstoraster_fuzzer_all_colors.cc	2
gs_fuzzlib.h	9
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_pgmraw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1673	70.4%
gold	[1:9]	8	0.33%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	692	29.1%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6524

Functions that are reachable but not covered

502

Reachable functions

929

Percentage of reachable functions covered

45.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_pgmraw_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_pxlcolor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1682	70.8%
gold	[1:9]	8	0.33%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	683	28.7%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6729

Functions that are reachable but not covered

497

Reachable functions

929

Percentage of reachable functions covered

46.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_pxlcolor_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_pdfwrite_opts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1811	76.2%
gold	[1:9]	5	0.21%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	557	23.4%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
169	757	gdev_mem_bits_size	call site: 00757	gx_saved_pages_list_print
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
100	1775	gs_parse_file_name	call site: 01775	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
67	1298	gx_semaphore_free	call site: 01298	gx_saved_pages_param_process
65	1034	memfile_init_empty	call site: 01034	memfile_fwrite_chars
58	1140	memfile_set_memory_warning	call site: 01140	pl_main_arg_fopen
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf

Runtime coverage analysis

Covered functions

6723

Functions that are reachable but not covered

521

Reachable functions

929

Percentage of reachable functions covered

43.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_pdfwrite_opts_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_tiffsep1_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1659	69.8%
gold	[1:9]	2	0.08%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	2	0.08%
lawngreen	50+	712	29.9%
All colors	2376	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1368	gs_add_control_path_len	call site: 01368	handle_dash_c
101	1776	gs_findiodevice	call site: 01776	pjl_set_fs_download_state
98	2059	gs_add_outputfile_control_path	call site: 02059	pl_main_set_parsed_param
85	1685	gs_snprintf	call site: 01685	pjl_set
85	1968	gp_unlink	call site: 01968	pjl_parse_and_process_line
69	859	gdev_prn_allocate	call site: 00859	gx_saved_pages_list_print
50	2325	sfclose	call site: 02325	gsapi_exit
47	430	gs_lib_finit	call site: 00430	gsapi_init_with_args
43	2280	sreadbuf	call site: 02280	s_process_read_buf
38	1225	check_device_compatible_encoding	call site: 01225	gx_output_saved_page
36	1535	gp_file_dealloc	call site: 01535	pjl_parse_and_process_line
36	1639	apr_vformatter	call site: 01639	conv_os_thread_t

Runtime coverage analysis

Covered functions

6709

Functions that are reachable but not covered

505

Reachable functions

930

Percentage of reachable functions covered

45.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_tiffsep1_fuzzer.cc	4
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_png16m_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1675	70.5%
gold	[1:9]	2	0.08%
yellow	[10:29]	3	0.12%
greenyellow	[30:49]	2	0.08%
lawngreen	50+	692	29.1%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
100	1775	gs_parse_file_name	call site: 01775	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6471

Functions that are reachable but not covered

504

Reachable functions

929

Percentage of reachable functions covered

45.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_png16m_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_pxlmono_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1693	71.3%
gold	[1:9]	3	0.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	678	28.5%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6592

Functions that are reachable but not covered

498

Reachable functions

929

Percentage of reachable functions covered

46.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_pxlmono_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_xpswrite_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1683	70.8%
gold	[1:9]	6	0.25%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	684	28.8%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6691

Functions that are reachable but not covered

499

Reachable functions

929

Percentage of reachable functions covered

46.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_xpswrite_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_pdfwrite_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1814	76.4%
gold	[1:9]	2	0.08%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	557	23.4%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
169	757	gdev_mem_bits_size	call site: 00757	gx_saved_pages_list_print
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
67	1298	gx_semaphore_free	call site: 01298	gx_saved_pages_param_process
65	1034	memfile_init_empty	call site: 01034	memfile_fwrite_chars
58	1140	memfile_set_memory_warning	call site: 01140	pl_main_arg_fopen
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf

Runtime coverage analysis

Covered functions

7007

Functions that are reachable but not covered

518

Reachable functions

929

Percentage of reachable functions covered

44.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_pdfwrite_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_bmpmono_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1682	70.8%
gold	[1:9]	4	0.16%
yellow	[10:29]	3	0.12%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	685	28.8%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
39	1222	check_device_compatible_encoding	call site: 01222	gx_output_saved_page
38	760	gx_default_size_buf_device	call site: 00760	set_planar
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6534

Functions that are reachable but not covered

503

Reachable functions

929

Percentage of reachable functions covered

45.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_bmpmono_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_ps2write_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1667	70.2%
gold	[1:9]	7	0.29%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	700	29.4%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

7698

Functions that are reachable but not covered

493

Reachable functions

929

Percentage of reachable functions covered

46.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_ps2write_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_faxg3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1681	70.8%
gold	[1:9]	6	0.25%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	685	28.8%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
39	1222	check_device_compatible_encoding	call site: 01222	gx_output_saved_page
38	760	gx_default_size_buf_device	call site: 00760	set_planar
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6521

Functions that are reachable but not covered

501

Reachable functions

929

Percentage of reachable functions covered

46.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_faxg3_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_psdcmyk_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1663	70.0%
gold	[1:9]	12	0.50%
yellow	[10:29]	2	0.08%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	697	29.3%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	1223	check_device_compatible_encoding	call site: 01223	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line
36	1637	apr_vformatter	call site: 01637	conv_os_thread_t

Runtime coverage analysis

Covered functions

6192

Functions that are reachable but not covered

506

Reachable functions

929

Percentage of reachable functions covered

45.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_psdcmyk_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gstoraster_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1657	69.7%
gold	[1:9]	3	0.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	715	30.1%
All colors	2375	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1367	gs_add_control_path_len	call site: 01367	handle_dash_c
101	1775	gs_findiodevice	call site: 01775	pjl_set_fs_download_state
98	2058	gs_add_outputfile_control_path	call site: 02058	pl_main_set_parsed_param
85	1684	gs_snprintf	call site: 01684	pjl_set
85	1967	gp_unlink	call site: 01967	pjl_parse_and_process_line
69	858	gdev_prn_allocate	call site: 00858	gx_saved_pages_list_print
50	2324	sfclose	call site: 02324	gsapi_exit
47	429	gs_lib_finit	call site: 00429	gsapi_init_with_args
43	2279	sreadbuf	call site: 02279	s_process_read_buf
40	1222	clist_close_writer_and_init_reader	call site: 01222	gx_output_saved_page
38	761	gx_default_size_buf_device	call site: 00761	set_planar
36	1534	gp_file_dealloc	call site: 01534	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

6476

Functions that are reachable but not covered

504

Reachable functions

930

Percentage of reachable functions covered

45.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gstoraster_fuzzer.cc	2
gs_fuzzlib.h	9
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: gs_device_eps2write_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1669	70.3%
gold	[1:9]	5	0.21%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	700	29.4%
All colors	2374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
141	1366	gs_add_control_path_len	call site: 01366	handle_dash_c
101	1774	gs_findiodevice	call site: 01774	pjl_set_fs_download_state
98	2057	gs_add_outputfile_control_path	call site: 02057	pl_main_set_parsed_param
85	1683	gs_snprintf	call site: 01683	pjl_set
85	1966	gp_unlink	call site: 01966	pjl_parse_and_process_line
69	857	gdev_prn_allocate	call site: 00857	gx_saved_pages_list_print
50	2323	sfclose	call site: 02323	gsapi_exit
47	428	gs_lib_finit	call site: 00428	gsapi_init_with_args
43	2278	sreadbuf	call site: 02278	s_process_read_buf
38	760	gx_default_size_buf_device	call site: 00760	set_planar
37	1224	check_device_compatible_encoding	call site: 01224	gx_output_saved_page
36	1533	gp_file_dealloc	call site: 01533	pjl_parse_and_process_line

Runtime coverage analysis

Covered functions

7473

Functions that are reachable but not covered

493

Reachable functions

929

Percentage of reachable functions covered

46.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gs_device_eps2write_fuzzer.cc	2
gs_fuzzlib.h	8
ghostpdl/pcl/pl/plapi.c	12
ghostpdl/base/gsmalloc.c	18
ghostpdl/jbig2dec/memento.c	10
ghostpdl/base/gxsync.c	7
ghostpdl/base/gp_psync.c	14
ghostpdl/base/gslibctx.c	52
ghostpdl/base/gsicc_lcms2mt.c	5
ghostpdl/lcms2mtcmsplugin.c	48
ghostpdl/lcms2mtcmserr.c	18
ghostpdl/lcms2mtlcms2_internal.h	2
ghostpdl/lcms2mtcmsintrp.c	3
ghostpdl/lcms2mtcmstypes.c	6
ghostpdl/lcms2mtcmspack.c	5
ghostpdl/lcms2mtcmscnvrt.c	5
ghostpdl/lcms2mtcmsgamma.c	6
ghostpdl/lcms2mtcmsopt.c	5
ghostpdl/lcms2mtcmsxform.c	4
ghostpdl/base/gp_os2.c	9
ghostpdl/base/gsmemory.c	3
ghostpdl/base/gpmisc.c	28
ghostpdl/base/gp_unifn.c	1
ghostpdl/base/gp_os2fs.c	1
ghostpdl/base/gsmemret.c	1
ghostpdl/base/gsmchunk.c	13
ghostpdl/pcl/pl/plmain.c	137
ghostpdl/base/gsdevice.c	16
ghostpdl/pcl/pl/pltop.c	29
ghostpdl/base/gsiodev.c	16
ghostpdl/base/gsinit.c	3
ghostpdl/base/gxfapi.c	1
ghostpdl/base/gsargs.c	17
ghostpdl/base/gsmisc.c	6
ghostpdl/base/gdevdflt.c	8
ghostpdl/base/gxclpage.c	47
ghostpdl/base/gdevprn.c	29
ghostpdl/base/gxclist.c	43
ghostpdl/devices/gdevdsp.c	7
ghostpdl/base/gdevmem.c	2
ghostpdl/base/gdevmpla.c	6
ghostpdl/cups/gdevcups.c	1
ghostpdl/devices/gdevplib.c	4
ghostpdl/freetypecache/ftccache.c	1
ghostpdl/freetypecache/ftcmru.c	3
ghostpdl/base/gsparams.c	16
ghostpdl/toolbin/halftone/gen_ordered/gen_ordered_main.c	3
ghostpdl/base/strmio.c	14
ghostpdl/base/sfxcommon.c	20
ghostpdl/base/sfxstdio.c	7
ghostpdl/base/gxclutil.c	31
ghostpdl/base/gxclread.c	22
ghostpdl/base/gxclmem.c	21
ghostpdl/base/gsicc_manage.c	5
ghostpdl/base/gsicc_cache.c	8
ghostpdl/base/gsdparam.c	2
ghostpdl/base/gxclthrd.c	21
ghostpdl/zlib/gzlib.c	3
ghostpdl/ijs/ijs_server.c	17
ghostpdl/ijs/ijs.c	4
ghostpdl/toolbin/tests/fuzzy.c	1
ghostpdl/base/gsstrtok.c	2
ghostpdl/pcl/pl/pjtop.c	2
ghostpdl/pcl/pl/pjparse.c	70
ghostpdl/base/gp.h	1
ghostpdl/base/gssprintf.c	35
ghostpdl/base/gsstrl.c	1
ghostpdl/base/gsfname.c	3
ghostpdl/base/gsioram.c	7
ghostpdl/base/ramfs.c	1
ghostpdl/base/gsparaml.c	29
ghostpdl/base/stream.c	9

Fuzzer: ghostpdl/expat/fuzz/xml_parsebuffer_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	427	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.23%
All colors	428	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
427	0	EP	call site: 00000	XML_ExternalEntityParserCreate

Runtime coverage analysis

Covered functions

9176

Functions that are reachable but not covered

110

Reachable functions

112

Percentage of reachable functions covered

1.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ghostpdl/expat/fuzz/xml_parsebuffer_fuzzer.c	8
ghostpdl/expat/lib/xmlparse.c	83
ghostpdl/expat/fuzz/xml_parse_fuzzer.c	11
ghostpdl/expat/lib/siphash.h	8
ghostpdl/demos/MATLAB/gs_displaydevice.c	2
ghostpdl/toolbin/bmpcmp.c	6

Fuzzer: ghostpdl/expat/fuzz/xml_parse_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	427	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.23%
All colors	428	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
427	0	EP	call site: 00000	XML_ExternalEntityParserCreate

Runtime coverage analysis

Covered functions

9176

Functions that are reachable but not covered

110

Reachable functions

112

Percentage of reachable functions covered

1.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ghostpdl/expat/fuzz/xml_parse_fuzzer.c	19
ghostpdl/expat/lib/xmlparse.c	83
ghostpdl/expat/lib/siphash.h	8
ghostpdl/demos/MATLAB/gs_displaydevice.c	2
ghostpdl/toolbin/bmpcmp.c	6

Fuzzer: ghostpdl/brotli/c/fuzz/decode_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	283	99.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.35%
All colors	284	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
283	0	EP	call site: 00000	BrotliDecoderDecompressStream

Runtime coverage analysis

Covered functions

9176

Functions that are reachable but not covered

99

Reachable functions

100

Percentage of reachable functions covered

1.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ghostpdl/brotli/c/fuzz/decode_fuzzer.c	5
ghostpdl/brotli/c/dec/decode.c	76
ghostpdl/brotli/c/dec/state.c	7
ghostpdl/brotli/c/common/shared_dictionary.c	6
ghostpdl/brotli/c/dec/bit_reader.h	13
ghostpdl/brotli/c/dec/bit_reader.c	2
ghostpdl/brotli/c/dec/huffman.c	8
ghostpdl/brotli/c/common/platform.h	3

Fuzzer: ghostpdl/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1333	96.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	50	3.61%
All colors	1383	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
268	136	png_destroy_png_struct	call site: 00136	png_read_row
221	406	png_calculate_crc	call site: 00406	png_read_row
174	786	png_colorspace_check_gamma	call site: 00786	png_handle_pCAL
157	1012	png_colorspace_set_sRGB	call site: 01012	png_handle_iCCP
149	1190	png_set_text_2	call site: 01190	png_read_row
147	630	png_set_IHDR	call site: 00630	png_handle_cHRM
48	961	png_set_pHYs	call site: 00961	png_handle_sRGB
47	0	EP	call site: 00000	png_read_info
24	1358	png_destroy_write_struct	call site: 01358	png_image_finish_read
23	76	png_free_data	call site: 00076
22	48	png_reset_crc	call site: 00048	clean_display
19	101	png_destroy_info_struct	call site: 00101	png_destroy_info_struct

Runtime coverage analysis

Covered functions

9176

Functions that are reachable but not covered

273

Reachable functions

300

Percentage of reachable functions covered

9.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ghostpdl/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc	29
ghostpdl/libpng/png.c	66
ghostpdl/libpng/pngrtran.c	48
ghostpdl/libpng/pngerror.c	17
ghostpdl/libpng/pngrio.c	3
ghostpdl/libpng/pngread.c	62
ghostpdl/libpng/pngrutil.c	92
ghostpdl/zlib/crc32.c	8
ghostpdl/contrib/pcl3gdevpcl3.c	5
ghostpdl/contrib/pcl3pclcap.c	3
ghostpdl/libpng/contrib/libtests/pngunknown.c	31
ghostpdl/zlib/inflate.c	5
ghostpdl/libpng/pngmem.c	3
ghostpdl/libpng/pngset.c	23
ghostpdl/libpng/arm/palette_neon_intrinsics.c	11
ghostpdl/libpng/pngtrans.c	2
ghostpdl/libpng/pngget.c	2
ghostpdl/base/gsalloc.c	7
ghostpdl/zlib/adler32.c	4
ghostpdl/libpng/pngwrite.c	7
ghostpdl/zlib/deflate.c	3
ghostpdl/libpng/pngwutil.c	1