High level conclusions

Fuzzer fuzz_inet_address_new_from_string is blocked:

The runtime code coverage of fuzz_inet_address_new_from_string covers 21.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_uri_parse_params is blocked:

The runtime code coverage of fuzz_uri_parse_params covers 23.05% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_key is blocked:

The runtime code coverage of fuzz_key covers 15.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_data_input_stream_read_line_utf8 is blocked:

The runtime code coverage of fuzz_data_input_stream_read_line_utf8 covers 27.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_uri_escape is blocked:

The runtime code coverage of fuzz_uri_escape covers 10.79% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_utf8_normalize is blocked:

The runtime code coverage of fuzz_utf8_normalize covers 9.174% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_string is blocked:

The runtime code coverage of fuzz_string covers 12.09% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_uuid_string_is_valid is blocked:

The runtime code coverage of fuzz_uuid_string_is_valid covers 7.165% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_network_address_parse is blocked:

The runtime code coverage of fuzz_network_address_parse covers 26.39% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_paths is blocked:

The runtime code coverage of fuzz_paths covers 7.098% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_inet_socket_address_new_from_string is blocked:

The runtime code coverage of fuzz_inet_socket_address_new_from_string covers 25.43% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_utf8_validate is blocked:

The runtime code coverage of fuzz_utf8_validate covers 7.278% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_data_input_stream_read_line is blocked:

The runtime code coverage of fuzz_data_input_stream_read_line covers 26.71% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_inet_address_mask_new_from_string is blocked:

The runtime code coverage of fuzz_inet_address_mask_new_from_string covers 29.10% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_date_parse is blocked:

The runtime code coverage of fuzz_date_parse covers 24.23% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_date_time_new_from_iso8601 is blocked:

The runtime code coverage of fuzz_date_time_new_from_iso8601 covers 20.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_data_input_stream_read_upto is blocked:

The runtime code coverage of fuzz_data_input_stream_read_upto covers 26.86% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_canonicalize_filename is blocked:

The runtime code coverage of fuzz_canonicalize_filename covers 9.705% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_get_locale_variants is blocked:

The runtime code coverage of fuzz_get_locale_variants covers 11.20% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 12.84% of cyclomatic complexity.

Fuzzers reach 6.676% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1044 / 15637

Cyclomatic complexity statically reachable by fuzzers

4847 / 37732

Runtime code coverage of functions

1194 / 15637

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_get_locale_variants

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1374	92.1%
gold	[1:9]	20	1.34%
yellow	[10:29]	49	3.28%
greenyellow	[30:49]	14	0.93%
lawngreen	50+	34	2.28%
All colors	1491	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
419	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
179	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
4	296	g_realloc	call site: 00296
4	1475	g_ptr_array_free	call site: 01475
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237
2	1453	g_stpcpy	call site: 01453
1	1225	g_slice_free1	call site: 01225

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

301

Reachable functions

339

Percentage of reachable functions covered

11.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_get_locale_variants.c	9
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	15
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gcharset.c	14
glib/garray.c	22
glib/gutilsprivate.h	1

Fuzzer: fuzz_canonicalize_filename

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1429	93.7%
gold	[1:9]	22	1.44%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	4.78%
All colors	1525	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
419	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
179	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
33	1420	g_canonicalize_filename	call site: 01420	g_get_current_dir
11	1481	g_build_path_va	call site: 01481	g_build_pathname_va
7	1497	g_path_skip_root	call site: 01497
4	296	g_realloc	call site: 00296
4	1506	g_path_skip_root	call site: 01506	g_build_filename
3	1466	g_string_sized_new	call site: 01466	g_string_sized_new

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

307

Reachable functions

340

Percentage of reachable functions covered

9.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_canonicalize_filename.c	5
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	8
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	17
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gfileutils.c	30
glib/gstdio.c	1
glib/gstring.c	8
glib/gutilsprivate.h	1

Fuzzer: fuzz_data_input_stream_read_upto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1600	66.6%
gold	[1:9]	286	11.9%
yellow	[10:29]	44	1.83%
greenyellow	[30:49]	25	1.04%
lawngreen	50+	444	18.5%
All colors	2399	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
152	8	g_mutex_unlock	call site: 00008	g_error
144	2061	type_node_check_conformities_UorL	call site: 02061	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
65	786	g_free_sized	call site: 00786	g_signal_emit
61	1806	object_ref	call site: 01806	g_signal_group_set_target
54	1978	object_set_property	call site: 01978	g_value_transform
47	1913	object_set_optional_flags	call site: 01913	g_signal_emit
43	1868	g_clear_object	call site: 01868	g_signal_group_bind
40	1433	g_type_class_get	call site: 01433	type_data_ref_Wm
37	167	g_rw_lock_writer_unlock	call site: 00167	g_utf8_to_utf16
34	1374	g_signal_new	call site: 01374	g_signal_new

Runtime coverage analysis

Covered functions

415

Functions that are reachable but not covered

501

Reachable functions

685

Percentage of reachable functions covered

26.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_data_input_stream_read_upto.c	10
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	11
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	3
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	175
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gmemoryinputstream.c	13
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
glib/gbytes.c	7
gio/gdatainputstream.c	16
gio/gbufferedinputstream.c	17
glib/tests/protocol.c	2
gio/ginputstream.c	11
gio/gcancellable.c	5

Fuzzer: fuzz_date_time_new_from_iso8601

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2720	86.6%
gold	[1:9]	64	2.03%
yellow	[10:29]	54	1.72%
greenyellow	[30:49]	23	0.73%
lawngreen	50+	277	8.82%
All colors	3138	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
385	1749	utf8_verify_ascii	call site: 01749	g_canonicalize_filename
251	786	g_free_sized	call site: 00786	g_signal_emit
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
194	2248	rules_from_identifier	call site: 02248	parse_identifier_boundaries
174	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
169	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
147	2754	g_date_time_format_utf8	call site: 02754	g_date_time_format_locale
140	398	g_hash_table_insert	call site: 00398	g_object_class_install_properties
88	38	g_strcmp0	call site: 00038	g_log_default_handler
74	1425	g_time_zone_new_identifier	call site: 01425	zone_identifier_unix
64	1668	g_utf8_get_charset_internal	call site: 01668	g_strsplit
62	3005	g_date_time_get_minute	call site: 03005	g_date_time_format_locale

Runtime coverage analysis

Covered functions

149

Functions that are reachable but not covered

507

Reachable functions

634

Percentage of reachable functions covered

20.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_date_time_new_from_iso8601.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	53
glib/gthread.c	16
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	48
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	33
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	28
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	18
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gdatetime.c	99
glib/gtimezone.c	132
glib/gfileutils.c	73
glib/gstdio.c	26
glib/gstdio-private.c	7
glib/gstring.c	22
glib/gutilsprivate.h	3
glib/gconvert.c	42
glib/gcharset.c	22
glib/libcharset/localcharset.c	21
glib/garray.c	29
glib/win_iconv.c	33
glib/tests/protocol.c	2
glib/gdir.c	10
glib/gwin32.c	5
.gitlab-ci/coverity-model.c	1
glib/guniprop.c	29
glib/gdate.c	12
glib/gmappedfile.c	25
glib/gbytes.c	6
glib/gvariant-parser.c	5
glib/gunidecomp.c	6
glib/gdatetime-private.c	18

Fuzzer: fuzz_resolver

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1631	70.3%
gold	[1:9]	60	2.58%
yellow	[10:29]	36	1.55%
greenyellow	[30:49]	15	0.64%
lawngreen	50+	575	24.8%
All colors	2317	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
303	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
175	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
134	1090	g_rec_mutex_unlock	call site: 01090	signal_emit_unlocked_R
102	681	g_rec_mutex_lock	call site: 00681	g_weak_ref_set
98	22	g_vasprintf	call site: 00022	g_log_default_handler
81	541	g_slist_free_1	call site: 00541	g_signal_new
78	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
46	2066	g_variant_valist_new_leaf	call site: 02066	g_variant_valist_new
31	507	g_type_from_name	call site: 00507	g_param_spec_pool_insert
30	248	g_error_allocate	call site: 00248	g_signal_group_class_init
30	2125	_g_variant_builder_init	call site: 02125	g_variant_type_element
28	652	g_bsearch_array_create	call site: 00652	g_signal_group__target_weak_notify

Runtime coverage analysis

Covered functions

295

Functions that are reachable but not covered

327

Reachable functions

517

Percentage of reachable functions covered

36.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_resolver.c	6
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	13
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	32
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gthreadedresolver.c	23
glib/tests/protocol.c	2
glib/gvariant.c	106
glib/gvarianttype.c	24
glib/gvarianttypeinfo.c	47
glib/gstring.c	8
glib/gutilsprivate.h	1
glib/gvariant-core.c	35
glib/garray.c	24
glib/gbytes.c	12
glib/gvariant-serialiser.c	6
glib/glist.c	4

Fuzzer: fuzz_variant_binary_byteswap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1472	65.9%
gold	[1:9]	34	1.52%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	726	32.5%
All colors	2233	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
288	392	g_ignore_leak	call site: 00392	g_signal_group__target_weak_notify
251	786	g_free_sized	call site: 00786	g_signal_emit
200	8	g_mutex_unlock	call site: 00008	g_error
179	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
134	1090	g_rec_mutex_unlock	call site: 01090	signal_emit_unlocked_R
57	681	g_rec_mutex_lock	call site: 00681	g_weak_ref_set
43	2013	g_malloc	call site: 02013	g_variant_make_tuple_type
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
39	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
26	364	g_malloc0	call site: 00364	g_intern_static_string
21	1889	g_variant_type_new_tuple	call site: 01889	g_variant_type_new_tuple_slow
17	752	g_bit_lock_and_get	call site: 00752	weak_ref_data_has

Runtime coverage analysis

Covered functions

253

Functions that are reachable but not covered

359

Reachable functions

549

Percentage of reachable functions covered

34.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_variant_binary_byteswap.c	6
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	8
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gvariant.c	109
glib/gvarianttype.c	24
glib/gbytes.c	13
glib/gvariant-core.c	63
glib/gvarianttypeinfo.c	48
glib/gvariant-serialiser.c	26
glib/garray.c	18
glib/gutilsprivate.h	1
glib/gstring.c	8

Fuzzer: fuzz_date_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1870	84.8%
gold	[1:9]	47	2.13%
yellow	[10:29]	35	1.58%
greenyellow	[30:49]	34	1.54%
lawngreen	50+	219	9.93%
All colors	2205	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	788	g_free_sized	call site: 00788	g_signal_group__target_weak_notify
391	394	g_ignore_leak	call site: 00394	g_signal_group__target_weak_notify
227	1545	g_nearest_pow	call site: 01545	append_month_name
159	1231	g_slice_free1	call site: 01231	g_signal_group__target_weak_notify
118	10	g_mutex_unlock	call site: 00010	g_error
90	1857	try_conversion	call site: 01857	message
78	155	g_private_set	call site: 00155	writer_func
58	303	g_hash_table_setup_storage	call site: 00303	g_hash_table_add
47	1969	g_convert_with_iconv	call site: 01969	g_realloc
37	243	g_slice_alloc	call site: 00243	g_signal_group_class_init
29	2019	g_locale_to_utf8	call site: 02019	g_error_free
26	366	g_malloc0	call site: 00366	g_intern_static_string

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

297

Reachable functions

392

Percentage of reachable functions covered

24.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_date_parse.c	7
glib/gdate.c	67
fuzzing/fuzz.h	1
glib/gmessages.c	53
glib/gthread.c	16
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	26
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	26
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	27
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	18
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/garray.c	23
glib/gutilsprivate.h	1
glib/gvariant-parser.c	5
glib/gconvert.c	29
glib/gcharset.c	21
glib/libcharset/localcharset.c	21
glib/win_iconv.c	33
glib/tests/protocol.c	2
glib/gdir.c	10
glib/gwin32.c	5
glib/guniprop.c	10
glib/gstring.c	14
glib/gunidecomp.c	17

Fuzzer: fuzz_inet_address_mask_new_from_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1493	63.9%
gold	[1:9]	213	9.12%
yellow	[10:29]	80	3.42%
greenyellow	[30:49]	56	2.39%
lawngreen	50+	492	21.0%
All colors	2334	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
78	22	g_vasprintf	call site: 00022	g_pattern_match_simple
65	786	g_free_sized	call site: 00786	g_signal_emit
65	2143	g_strdup_value_contents	call site: 02143	g_value_peek_pointer
61	1834	object_ref	call site: 01834	g_signal_group_set_target
47	1941	object_set_optional_flags	call site: 01941	g_signal_emit
43	1896	g_clear_object	call site: 01896	g_signal_group_bind
40	1461	g_type_class_get	call site: 01461	type_data_ref_Wm
36	1756	g_diagnostic_is_enabled	call site: 01756	g_object_new_with_custom_constructor
32	1684	type_iface_vtable_iface_init_Wm	call site: 01684	g_signal_override_class_closure
30	909	g_value_unset	call site: 00909	g_object_unref

Runtime coverage analysis

Covered functions

412

Functions that are reachable but not covered

475

Reachable functions

670

Percentage of reachable functions covered

29.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_inet_address_mask_new_from_string.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	11
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	1
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/ginetaddressmask.c	15
glib/tests/protocol.c	2
gio/ginetaddress.c	10
gio/gnetworking.c	5
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
gio/ginitable.c	11

Fuzzer: fuzz_dbus_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2435	56.6%
gold	[1:9]	279	6.49%
yellow	[10:29]	34	0.79%
greenyellow	[30:49]	75	1.74%
lawngreen	50+	1474	34.3%
All colors	4297	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
153	786	g_free_sized	call site: 00786	g_signal_emit
119	1934	object_set_optional_flags	call site: 01934	g_signal_emit
102	3436	g_variant_get_variant	call site: 03436	g_variant_print_string
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
100	2068	type_node_check_conformities_UorL	call site: 02068	g_strdup_value_contents
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
78	3356	parse_value_from_blob	call site: 03356	g_variant_print
76	3995	g_variant_valist_new_leaf	call site: 03995	g_variant_builder_end
68	1585	type_class_init_Wm	call site: 01585	type_iface_vtable_base_init_Wm
68	3662	g_variant_valist_get_leaf	call site: 03662	g_variant_get_strv
65	1867	ptr_array_remove_index	call site: 01867	g_signal_group_bind
62	38	g_strcmp0	call site: 00038	g_pattern_match_simple

Runtime coverage analysis

Covered functions

542

Functions that are reachable but not covered

595

Reachable functions

982

Percentage of reachable functions covered

39.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_dbus_message.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	53
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	29
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	30
glib/ghash.c	45
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	3
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	24
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	3
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gdbusmessage.c	159
glib/tests/protocol.c	2
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	18
gobject/gvaluetypes.c	30
glib/gstring.c	22
glib/gutilsprivate.h	1
gio/gdbusprivate.c	6
glib/gvarianttype.c	28
glib/gvariant.c	186
glib/gvariant-core.c	65
glib/gvarianttypeinfo.c	50
glib/gbytes.c	13
glib/gvariant-serialiser.c	26
glib/ggettext.c	7
glib/guniprop.c	3
.gitlab-ci/coverity-model.c	1
girepository/gitypelib.c	10
gio/gdbusutils.c	7
gio/gmemoryoutputstream.c	4
gio/gunixfdlist.c	2

Fuzzer: fuzz_data_input_stream_read_line

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1600	66.8%
gold	[1:9]	286	11.9%
yellow	[10:29]	44	1.83%
greenyellow	[30:49]	25	1.04%
lawngreen	50+	437	18.2%
All colors	2392	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
152	8	g_mutex_unlock	call site: 00008	g_error
144	2056	type_node_check_conformities_UorL	call site: 02056	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
65	786	g_free_sized	call site: 00786	g_signal_emit
61	1801	object_ref	call site: 01801	g_signal_group_set_target
54	1973	object_set_property	call site: 01973	g_value_transform
47	1908	object_set_optional_flags	call site: 01908	g_signal_emit
43	1863	g_clear_object	call site: 01863	g_signal_group_bind
40	1428	g_type_class_get	call site: 01428	type_data_ref_Wm
37	167	g_rw_lock_writer_unlock	call site: 00167	g_utf8_to_utf16
34	1374	g_signal_new	call site: 01374	g_signal_new

Runtime coverage analysis

Covered functions

414

Functions that are reachable but not covered

502

Reachable functions

685

Percentage of reachable functions covered

26.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_data_input_stream_read_line.c	8
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	10
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	3
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	175
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gmemoryinputstream.c	13
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
glib/gbytes.c	7
gio/gdatainputstream.c	15
gio/gbufferedinputstream.c	17
glib/tests/protocol.c	2
gio/ginputstream.c	11
gio/gcancellable.c	5

Fuzzer: fuzz_utf8_validate

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1376	94.0%
gold	[1:9]	33	2.25%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	54	3.69%
All colors	1463	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1044	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
4	296	g_realloc	call site: 00296
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237
1	1420	load_word	call site: 01420

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

293

Reachable functions

316

Percentage of reachable functions covered

7.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_utf8_validate.c	3
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	6
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	22
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11

Fuzzer: fuzz_uri_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1363	69.3%
gold	[1:9]	61	3.10%
yellow	[10:29]	41	2.08%
greenyellow	[30:49]	7	0.35%
lawngreen	50+	492	25.0%
All colors	1964	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
159	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
98	22	g_vasprintf	call site: 00022	g_log_default_handler
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
24	335	g_hash_table_insert_node	call site: 00335	g_hash_table_resize
22	127	g_private_get	call site: 00127	_g_private_get_impl
21	1862	remove_dot_segments	call site: 01862	remove_dot_segments
18	364	g_malloc0	call site: 00364	g_intern_static_string
14	407	quark_from_string	call site: 00407	g_intern_string
14	1601	parse_ip_literal	call site: 01601	message

Runtime coverage analysis

Covered functions

180

Functions that are reachable but not covered

286

Reachable functions

429

Percentage of reachable functions covered

33.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_uri_parse.c	8
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	18
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	26
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/guri.c	68
.gitlab-ci/coverity-model.c	1
glib/gstring.c	23
glib/gutilsprivate.h	1
glib/ghostutils.c	38
glib/tests/protocol.c	2
glib/guniprop.c	20
glib/gunidecomp.c	17
glib/garcbox.c	8

Fuzzer: fuzz_inet_socket_address_new_from_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1633	68.4%
gold	[1:9]	251	10.5%
yellow	[10:29]	75	3.14%
greenyellow	[30:49]	44	1.84%
lawngreen	50+	382	16.0%
All colors	2385	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
138	22	g_vasprintf	call site: 00022	g_log_default_handler
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
82	2068	type_node_check_conformities_UorL	call site: 02068	g_strdup_value_contents
65	786	g_free_sized	call site: 00786	g_signal_emit
61	1813	object_ref	call site: 01813	g_signal_group_set_target
59	2285	g_socket_address_new_from_native	call site: 02285	g_unix_socket_address_new_with_type
54	1985	object_set_property	call site: 01985	g_value_transform
47	1920	object_set_optional_flags	call site: 01920	g_signal_emit
43	1875	g_clear_object	call site: 01875	g_signal_group_bind
40	1440	g_type_class_get	call site: 01440	type_data_ref_Wm
37	167	g_rw_lock_writer_unlock	call site: 00167	g_utf8_to_utf16

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

513

Reachable functions

688

Percentage of reachable functions covered

25.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_inet_socket_address_new_from_string.c	8
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	11
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	41
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	1
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/ginetsocketaddress.c	14
gio/gsocketaddress.c	12
gio/ginetaddress.c	7
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	25
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
gio/gunixsocketaddress.c	6
glib/gvariant-parser.c	5
gio/gnativesocketaddress.c	4
gio/gnetworking.c	5
gio/gsocketconnectable.c	6
gobject/genums.c	8

Fuzzer: fuzz_paths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1402	95.1%
gold	[1:9]	29	1.96%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	41	2.78%
All colors	1474	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1044	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
10	1455	g_path_get_dirname	call site: 01455
7	1419	g_path_skip_root	call site: 01419
4	296	g_realloc	call site: 00296
3	1450	g_path_get_dirname	call site: 01450
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237
2	1415	g_path_is_absolute	call site: 01415
2	1428	g_path_skip_root	call site: 01428

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

301

Reachable functions

324

Percentage of reachable functions covered

7.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_paths.c	11
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	8
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gfileutils.c	12

Fuzzer: fuzz_network_address_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1613	69.3%
gold	[1:9]	286	12.3%
yellow	[10:29]	29	1.24%
greenyellow	[30:49]	56	2.40%
lawngreen	50+	341	14.6%
All colors	2325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
138	22	g_vasprintf	call site: 00022	g_log_default_handler
127	1820	_g_object_has_notify_handler	call site: 01820	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
82	2097	type_node_check_conformities_UorL	call site: 02097	g_strdup_value_contents
65	786	g_free_sized	call site: 00786	g_signal_emit
54	2014	object_set_property	call site: 02014	g_value_transform
47	1949	object_set_optional_flags	call site: 01949	g_signal_emit
40	1469	g_type_class_get	call site: 01469	type_data_ref_Wm
37	167	g_rw_lock_writer_unlock	call site: 00167	g_utf8_to_utf16
37	2204	g_string_append_printf	call site: 02204	g_signal_group_constructed
34	1374	g_signal_new	call site: 01374	g_signal_new

Runtime coverage analysis

Covered functions

362

Functions that are reachable but not covered

421

Reachable functions

572

Percentage of reachable functions covered

26.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_network_address_parse.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	11
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	1
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gnetworkaddress.c	12
glib/tests/protocol.c	2
gio/gnetworking.c	3
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
gio/gsocketconnectable.c	6
gobject/genums.c	8

Fuzzer: fuzz_uuid_string_is_valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1375	96.6%
gold	[1:9]	28	1.96%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	19	1.33%
All colors	1422	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1044	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
4	296	g_realloc	call site: 00296
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

298

Reachable functions

321

Percentage of reachable functions covered

7.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_uuid_string_is_valid.c	5
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	10
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/guuid.c	4

Fuzzer: fuzz_variant_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1486	67.6%
gold	[1:9]	34	1.54%
yellow	[10:29]	1	0.04%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	674	30.7%
All colors	2195	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
288	392	g_ignore_leak	call site: 00392	g_signal_group__target_weak_notify
251	786	g_free_sized	call site: 00786	g_signal_emit
200	8	g_mutex_unlock	call site: 00008	g_error
179	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
134	1090	g_rec_mutex_unlock	call site: 01090	signal_emit_unlocked_R
57	681	g_rec_mutex_lock	call site: 00681	g_weak_ref_set
43	1968	g_malloc	call site: 01968	g_variant_make_tuple_type
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
39	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
26	364	g_malloc0	call site: 00364	g_intern_static_string
21	1844	g_variant_type_new_tuple	call site: 01844	g_variant_type_new_tuple_slow
17	752	g_bit_lock_and_get	call site: 00752	weak_ref_data_has

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

360

Reachable functions

546

Percentage of reachable functions covered

34.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_variant_binary.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	8
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gvariant.c	102
glib/gvarianttype.c	24
glib/gbytes.c	13
glib/gvariant-core.c	65
glib/gvarianttypeinfo.c	48
glib/gvariant-serialiser.c	19
glib/garray.c	18
glib/gutilsprivate.h	1
glib/gstring.c	8

Fuzzer: fuzz_network_address_parse_uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1713	63.5%
gold	[1:9]	270	10.0%
yellow	[10:29]	37	1.37%
greenyellow	[30:49]	65	2.41%
lawngreen	50+	609	22.6%
All colors	2694	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
138	22	g_vasprintf	call site: 00022	g_log_default_handler
127	2211	_g_object_has_notify_handler	call site: 02211	g_signal_group_constructed
121	2488	type_node_check_conformities_UorL	call site: 02488	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
85	854	g_type_value_table_peek	call site: 00854	g_object_unref
67	786	g_free_sized	call site: 00786	g_signal_emit
54	2405	object_set_property	call site: 02405	g_value_transform
47	2340	object_set_optional_flags	call site: 02340	g_signal_emit
40	1860	g_type_class_get	call site: 01860	type_data_ref_Wm
36	2155	g_diagnostic_is_enabled	call site: 02155	g_object_new_with_custom_constructor
32	2083	type_iface_vtable_iface_init_Wm	call site: 02083	g_signal_override_class_closure

Runtime coverage analysis

Covered functions

412

Functions that are reachable but not covered

442

Reachable functions

643

Percentage of reachable functions covered

31.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_network_address_parse_uri.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	19
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	25
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	1
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gnetworkaddress.c	4
glib/guri.c	51
.gitlab-ci/coverity-model.c	1
glib/gstring.c	22
glib/gutilsprivate.h	1
glib/ghostutils.c	38
glib/tests/protocol.c	2
glib/guniprop.c	20
glib/gunidecomp.c	17
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
gio/gsocketconnectable.c	6
gobject/genums.c	8

Fuzzer: fuzz_variant_text

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1580	57.9%
gold	[1:9]	64	2.34%
yellow	[10:29]	4	0.14%
greenyellow	[30:49]	6	0.22%
lawngreen	50+	1073	39.3%
All colors	2727	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
251	786	g_free_sized	call site: 00786	g_signal_emit
169	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
139	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
134	1090	g_rec_mutex_unlock	call site: 01090	signal_emit_unlocked_R
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
78	22	g_vasprintf	call site: 00022	g_pattern_match_simple
57	681	g_rec_mutex_lock	call site: 00681	g_weak_ref_set
43	2113	g_variant_new_boolean	call site: 02113	g_variant_valist_new
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
39	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
35	1681	g_variant_type_is_array	call site: 01681	g_variant_make_tuple_type
28	1900	g_variant_builder_clear	call site: 01900	g_variant_new_array

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

363

Reachable functions

637

Percentage of reachable functions covered

43.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_variant_text.c	6
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	31
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	18
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gvariant-parser.c	74
glib/gstring.c	22
glib/gutilsprivate.h	1
.gitlab-ci/coverity-model.c	1
glib/gvariant.c	138
glib/gvarianttype.c	26
glib/gvarianttypeinfo.c	48
glib/gvariant-core.c	60
glib/garray.c	18
glib/gbytes.c	13
glib/gvariant-serialiser.c	15
gobject/genums.c	2
glib/guniprop.c	3

Fuzzer: fuzz_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1375	91.2%
gold	[1:9]	20	1.32%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	3	0.19%
lawngreen	50+	108	7.16%
All colors	1507	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
419	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
179	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
4	296	g_realloc	call site: 00296
4	1450	g_ptr_array_free	call site: 01450
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237
2	1416	g_strsplit	call site: 01416	g_ptr_array_new
1	1225	g_slice_free1	call site: 01225

Runtime coverage analysis

Covered functions

52

Functions that are reachable but not covered

298

Reachable functions

339

Percentage of reachable functions covered

12.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_string.c	11
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	18
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/garray.c	22
glib/gutilsprivate.h	1
glib/gstring.c	18

Fuzzer: fuzz_utf8_normalize

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1375	94.2%
gold	[1:9]	28	1.91%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	3.83%
All colors	1459	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1024	364	g_malloc0	call site: 00364	g_signal_group__target_weak_notify
223	8	g_mutex_unlock	call site: 00008	g_error
58	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
42	241	g_slice_alloc	call site: 00241	g_signal_group_class_init
8	1400	g_utf8_get_char	call site: 01400	g_private_set
5	1438	_g_utf8_normalize_wc	call site: 01438	combine
4	296	g_realloc	call site: 00296
3	1395	g_try_malloc	call site: 01395	g_set_error_literal
2	5	g_mutex_lock	call site: 00005	g_mutex_unlock
2	237	g_malloc	call site: 00237
2	1423	g_utf8_strlen	call site: 01423
2	1445	g_utf8_normalize	call site: 01445	g_set_error_literal

Runtime coverage analysis

Covered functions

39

Functions that are reachable but not covered

297

Reachable functions

327

Percentage of reachable functions covered

9.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_utf8_normalize.c	8
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	6
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	16
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gunidecomp.c	17

Fuzzer: fuzz_uri_escape

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2112	94.0%
gold	[1:9]	76	3.38%
yellow	[10:29]	13	0.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	45	2.00%
All colors	2246	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
254	1600	g_utf8_get_char_validated	call site: 01600	g_key_file_locale_is_interesting
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
185	8	g_mutex_unlock	call site: 00008	g_error
163	2082	g_bytes_get_size	call site: 02082	g_variant_get_string
148	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
112	1969	LLVMFuzzerTestOneInput	call site: 01969	g_variant_new_string
87	1511	g_string_sized_new	call site: 01511	g_key_file_flush_parse_buffer
70	1435	g_bytes_get_data	call site: 01435	g_key_file_load_from_data
64	1868	g_error_free	call site: 01868	g_key_file_flush_parse_buffer
35	248	g_error_allocate	call site: 00248	g_signal_group_class_init

Runtime coverage analysis

Covered functions

106

Functions that are reachable but not covered

603

Reachable functions

676

Percentage of reachable functions covered

10.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_uri_escape.c	4
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	22
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	33
glib/gslist.c	9
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	28
glib/ghash.c	51
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	3
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/tests/keyfile.c	19
glib/gkeyfile.c	82
glib/glist.c	7
glib/gbytes.c	12
glib/gstring.c	7
glib/gutilsprivate.h	1
.gitlab-ci/coverity-model.c	1
glib/tests/protocol.c	2
glib/guniprop.c	2
glib/gcharset.c	40
glib/garray.c	24
glib/gstdio.c	6
glib/tests/gvariant.c	7
glib/gvariant.c	27
glib/gvariant-core.c	41
glib/gvarianttypeinfo.c	47
glib/gvarianttype.c	14
glib/gvariant-serialiser.c	11

Fuzzer: fuzz_bookmark

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1269	67.0%
gold	[1:9]	32	1.69%
yellow	[10:29]	16	0.84%
greenyellow	[30:49]	2	0.10%
lawngreen	50+	573	30.2%
All colors	1892	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
251	786	g_free_sized	call site: 00786	g_signal_emit
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
174	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
148	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
62	38	g_strcmp0	call site: 00038	g_pattern_match_simple
30	248	g_error_allocate	call site: 00248	g_signal_group_class_init
22	127	g_private_get	call site: 00127	_g_private_get_impl
20	1378	g_error_new_literal	call site: 01378	g_warning
18	364	g_malloc0	call site: 00364	g_intern_static_string
17	103	g_strdup_printf	call site: 00103	g_log_default_handler
15	22	g_vasprintf	call site: 00022	g_strcmp0

Runtime coverage analysis

Covered functions

285

Functions that are reachable but not covered

271

Reachable functions

425

Percentage of reachable functions covered

36.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_bookmark.c	5
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	13
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	31
glib/gslist.c	10
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	29
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/gbookmarkfile.c	17
glib/glist.c	3
glib/gmarkup.c	85
glib/gstring.c	5
glib/gutilsprivate.h	1
glib/guniprop.c	2

Fuzzer: fuzz_data_input_stream_read_line_utf8

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1601	65.3%
gold	[1:9]	286	11.6%
yellow	[10:29]	44	1.79%
greenyellow	[30:49]	25	1.02%
lawngreen	50+	494	20.1%
All colors	2450	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
152	8	g_mutex_unlock	call site: 00008	g_error
144	2056	type_node_check_conformities_UorL	call site: 02056	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
65	786	g_free_sized	call site: 00786	g_signal_emit
61	1801	object_ref	call site: 01801	g_signal_group_set_target
54	1973	object_set_property	call site: 01973	g_value_transform
47	1908	object_set_optional_flags	call site: 01908	g_signal_emit
43	1863	g_clear_object	call site: 01863	g_signal_group_bind
40	1428	g_type_class_get	call site: 01428	type_data_ref_Wm
37	167	g_rw_lock_writer_unlock	call site: 00167	g_utf8_to_utf16
34	1374	g_signal_new	call site: 01374	g_signal_new

Runtime coverage analysis

Covered functions

430

Functions that are reachable but not covered

494

Reachable functions

686

Percentage of reachable functions covered

27.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_data_input_stream_read_line_utf8.c	8
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	10
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	3
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	175
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/gmemoryinputstream.c	13
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1
glib/gbytes.c	7
gio/gdatainputstream.c	20
gio/gbufferedinputstream.c	17
glib/tests/protocol.c	2
gio/ginputstream.c	11
gio/gcancellable.c	5

Fuzzer: fuzz_key

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2171	90.4%
gold	[1:9]	27	1.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	0.20%
lawngreen	50+	196	8.17%
All colors	2399	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
300	1552	g_nearest_pow	call site: 01552	append_month_name
286	2110	g_string_maybe_expand	call site: 02110	g_date_set_parse
251	786	g_free_sized	call site: 00786	g_signal_emit
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
174	1050	g_hash_table_remove_internal	call site: 01050	g_signal_group__target_weak_notify
148	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
104	22	g_vasprintf	call site: 00022	g_log_default_handler
91	1946	g_set_error	call site: 01946	g_dir_open_with_errno
85	1854	g_strndup	call site: 01854	convert_checked
58	1481	utf8_verify	call site: 01481	g_date_prepare_to_parse
41	2051	g_error_free	call site: 02051	g_utf8_casefold

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

555

Reachable functions

654

Percentage of reachable functions covered

15.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_key.c	3
fuzzing/fuzz.h	1
glib/gmessages.c	58
glib/gthread.c	16
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	26
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	26
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	27
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	18
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/tests/date.c	17
glib/gdate.c	73
glib/garray.c	23
glib/gutilsprivate.h	1
glib/gvariant-parser.c	5
glib/gconvert.c	29
glib/gcharset.c	21
glib/libcharset/localcharset.c	21
glib/win_iconv.c	33
glib/tests/protocol.c	2
glib/gdir.c	10
glib/gwin32.c	5
glib/guniprop.c	10
glib/gstring.c	14
glib/gunidecomp.c	17

Fuzzer: fuzz_uri_parse_params

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1334	83.2%
gold	[1:9]	27	1.68%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	238	14.8%
All colors	1602	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
438	786	g_free_sized	call site: 00786	g_signal_group__target_weak_notify
242	541	g_slist_free_1	call site: 00541	g_signal_group__target_weak_notify
190	8	g_mutex_unlock	call site: 00008	g_error
148	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
114	424	quark_from_string_locked	call site: 00424	g_object_class_install_properties
35	248	g_error_allocate	call site: 00248	g_signal_group_class_init
30	1378	g_error_new_literal	call site: 01378	g_warning
18	364	g_malloc0	call site: 00364	g_intern_static_string
14	407	quark_from_string	call site: 00407	g_intern_string
14	1460	uri_decoder	call site: 01460	g_string_append_printf
10	301	g_hash_table_setup_storage	call site: 00301	g_hash_table_add
10	385	quark_from_string	call site: 00385	g_ignore_leak

Runtime coverage analysis

Covered functions

113

Functions that are reachable but not covered

267

Reachable functions

347

Percentage of reachable functions covered

23.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_uri_parse_params.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	7
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	23
glib/gslist.c	6
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	22
glib/ghash.c	51
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	15
gobject/gparamspecs.c	4
gobject/gparam.c	36
gobject/gbinding.c	1
gobject/gtype.c	46
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	110
gobject/gsignal.c	105
glib/gbsearcharray.h	16
gobject/gclosure.c	34
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	17
gobject/gboxed.c	5
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
glib/guri.c	30
glib/gstring.c	16
glib/gutilsprivate.h	1

Fuzzer: fuzz_inet_address_new_from_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1699	74.2%
gold	[1:9]	168	7.33%
yellow	[10:29]	229	10.0%
greenyellow	[30:49]	56	2.44%
lawngreen	50+	137	5.98%
All colors	2289	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
158	2055	type_node_check_conformities_UorL	call site: 02055	g_signal_group_constructed
152	8	g_mutex_unlock	call site: 00008	g_error
127	1792	_g_object_has_notify_handler	call site: 01792	g_signal_group_constructed
100	1124	g_type_free_instance	call site: 01124	signal_emit_unlocked_R
87	1229	g_slice_free1	call site: 01229	g_signal_group__target_weak_notify
85	854	g_type_value_table_peek	call site: 00854	g_object_unref
68	1572	type_class_init_Wm	call site: 01572	type_iface_vtable_base_init_Wm
67	786	g_free_sized	call site: 00786	g_signal_emit
54	1986	object_set_property	call site: 01986	g_value_transform
48	1654	type_class_init_Wm	call site: 01654	test_a_interface_init
47	1921	object_set_optional_flags	call site: 01921	g_signal_emit
40	1441	g_type_class_get	call site: 01441	type_data_ref_Wm

Runtime coverage analysis

Covered functions

297

Functions that are reachable but not covered

447

Reachable functions

573

Percentage of reachable functions covered

21.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/fuzz_inet_address_new_from_string.c	7
fuzzing/fuzz.h	1
glib/gmessages.c	49
glib/gthread.c	13
glib/gthread-win32.c	28
glib/gmessages.h	3
glib/gstrfuncs.c	11
glib/gprintf.c	11
glib/gnulib/printf.c	1
glib/gutils.c	5
glib/gtestutils.c	1
glib/gpattern.c	14
glib/gutf8.c	14
glib/gslist.c	7
glib/tests/messages-low-memory.c	2
glib/tests/rwlock.c	5
glib/gerror.c	16
glib/ghash.c	44
glib/tests/hash.c	1
glib/gslice.c	8
glib/gmem.c	14
gobject/gsignalgroup.c	38
gobject/gparamspecs.c	4
gobject/gparam.c	50
gobject/gbinding.c	1
gobject/gtype.c	102
glib/genviron.c	2
glib/gquark.c	23
glib/glib-private.h	3
gobject/gobject.c	174
gobject/gsignal.c	121
glib/gbsearcharray.h	16
gobject/gclosure.c	37
glib/gbitlock.c	18
glib/gdataset.c	13
gobject/gvalue.c	31
gobject/gboxed.c	11
glib/tests/mainloop.c	2
gobject/tests/reference.c	3
glib/ghook.c	11
gio/ginetaddress.c	10
gio/gnetworking.c	5
gobject/gtypeplugin.c	6
gobject/gtypemodule.c	8
gobject/tests/override.c	3
gobject/tests/type.c	1
glib/garray.c	5
gobject/gvaluetypes.c	30
glib/gstring.c	19
glib/gutilsprivate.h	1