High level conclusions

Fuzzer fuzzer_script_guess is blocked:

The runtime code coverage of fuzzer_script_guess covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 0.558% of cyclomatic complexity.

Fuzzers reach 0.286% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

5 / 1743

Cyclomatic complexity statically reachable by fuzzers

13 / 2329

Runtime code coverage of functions

559 / 1743

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer_script_gif

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	644	86.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.40%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	94	12.6%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
77	142	ImageLayout::total_bytes	call site: 00142	Orientation::locate_orientation_entry
76	223	MetadataBlock::get	call site: 00223	ImageReader::decode_into
65	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
30	89	ImageReader::fill_header_metadata_if_any	call site: 00089	ImageReader::decode_into
30	475	DecodedImageMetadata::access_block_with	call site: 00475	Delay::closest_bounded_fraction
30	585	decoder_to_image	call site: 00585	TgaDecoder::expand_color_map
22	560	ImageBuffer::from_raw	call site: 00560	ImageReader::decode_into
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	64	ImageBuffer::subpixels_mut	call site: 00064	ImageReader::decode_into
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
16	19	ImageReaderOptions::set_format	call site: 00019

Runtime coverage analysis

Covered functions

215

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_gif.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_pnm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	637	85.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	23	3.10%
greenyellow	[30:49]	4	0.53%
lawngreen	50+	77	10.3%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
149	150	PnmHeader::subtype	call site: 00150	ImageReader::decode_into
123	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
65	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
40	434	ImageLayout::total_bytes_overflows_u64	call site: 00434	ImageReader::decode_into
37	475	DecodedImageMetadata::access_block_with	call site: 00475	ImageReader::decode_to_dynimage
35	84	ImageDecoder::format_attributes	call site: 00084	ImageReader::decode_into
26	56	ImageBuffer::image_buffer_len	call site: 00056	ImageReader::decode_into
21	561	decoder_to_image	call site: 00561	ImageReader::decode_into
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
18	632	DecodedImageMetadata::exif_metadata	call site: 00632	Moxcms::parse_icc
16	19	ImageReaderOptions::set_format	call site: 00019

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_pnm.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: roundtrip_webp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	701	89.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	78	10.0%
All colors	779	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
97	408	ImageReader::set_limits	call site: 00408	ImageReader::into_frames
79	163	MetadataBlock::get	call site: 00163	ImageReader::decode_into
77	250	Limits::check_dimensions	call site: 00250	ImageReader::decode_into
74	67	ImageLayout::total_bytes	call site: 00067	Orientation::locate_orientation_entry
65	690	DecodedImageMetadata::apply_metdata	call site: 00690	Orientation::locate_orientation_entry
57	507	MetadataBlock::get	call site: 00507	ImageReader::decode_to_dynimage
33	586	ImageLayout::total_bytes	call site: 00586	ImageReader::decode_into
32	12	ImageReader::fill_header_metadata_if_any	call site: 00012	ImageReader::decode_into
30	622	decoder_to_image	call site: 00622	TgaDecoder::expand_color_map
29	342	ImageBuffer::from_raw	call site: 00342	Header::write_to
21	757	ImageReader::decode_to_dynimage	call site: 00757	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	45	ImageLayout::total_bytes	call site: 00045	Enlargeable::clamp_from

Runtime coverage analysis

Covered functions

170

Functions that are reachable but not covered

7

Reachable functions

17

Percentage of reachable functions covered

58.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/roundtrip_webp.rs	11
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/image_reader_type.rs	60
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/hooks.rs	30
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/images/buffer.rs	14
src/images/buffer_par.rs	3
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/avif/encoder.rs	4
src/codecs/tga/header.rs	4
src/images/dynimage.rs	19
src/io/free_functions.rs	15
tests/limits_anim.rs	7
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_bmp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	645	87.0%
gold	[1:9]	3	0.40%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.26%
lawngreen	50+	91	12.2%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
157	142	ImageLayout::total_bytes	call site: 00142	ImageReader::decode_into
72	402	ParsedCoreHeader::parse	call site: 00402	ImageReader::decode_into
67	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
65	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
37	475	DecodedImageMetadata::access_block_with	call site: 00475	ImageReader::decode_to_dynimage
36	83	ImageReader::fill_header_metadata_if_any	call site: 00083	ImageReader::decode_into
30	585	decoder_to_image	call site: 00585	TgaDecoder::expand_color_map
26	56	ImageBuffer::image_buffer_len	call site: 00056	ImageReader::decode_into
21	561	decoder_to_image	call site: 00561	ImageReader::decode_into
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
18	632	DecodedImageMetadata::exif_metadata	call site: 00632	Moxcms::parse_icc

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_bmp.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_webp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	630	85.0%
gold	[1:9]	5	0.67%
yellow	[10:29]	18	2.42%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	87	11.7%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
77	142	ImageLayout::total_bytes	call site: 00142	Orientation::locate_orientation_entry
45	673	Orientation::from_exif_chunk	call site: 00673	rotate90_in
44	226	MetadataBlock::get	call site: 00226	overlay_bounds_ext
40	464	MetadataBlock::get	call site: 00464	Delay::closest_bounded_fraction
30	585	decoder_to_image	call site: 00585	TgaDecoder::expand_color_map
29	90	ImageReader::fill_header_metadata_if_any	call site: 00090	ImageReader::decode_into
28	271	MetadataBlock::get	call site: 00271	ImageReader::decode_into
26	56	ImageBuffer::image_buffer_len	call site: 00056	ImageReader::decode_into
21	561	decoder_to_image	call site: 00561	ImageReader::decode_into
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from

Runtime coverage analysis

Covered functions

377

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_webp.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_ico

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	631	85.1%
gold	[1:9]	5	0.67%
yellow	[10:29]	9	1.21%
greenyellow	[30:49]	4	0.53%
lawngreen	50+	92	12.4%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
79	220	MetadataBlock::get	call site: 00220	ImageReader::decode_into
77	142	ImageLayout::total_bytes	call site: 00142	Orientation::locate_orientation_entry
65	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
55	309	Box::read_image	call site: 00309	ImageReader::decode_into
51	402	ParsedCoreHeader::parse	call site: 00402	ImageReader::decode_into
37	475	DecodedImageMetadata::access_block_with	call site: 00475	ImageReader::decode_to_dynimage
33	549	ImageBuffer::check_image_fits	call site: 00549	ImageReader::decode_into
29	90	ImageReader::fill_header_metadata_if_any	call site: 00090	ImageReader::decode_into
22	56	ImageBuffer::image_buffer_len	call site: 00056	ReferenceTestCase::from_str
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
19	455	MetadataBlock::get	call site: 00455	MetadataBlock::get
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from

Runtime coverage analysis

Covered functions

501

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_ico.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_png

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	621	83.8%
gold	[1:9]	6	0.80%
yellow	[10:29]	11	1.48%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	102	13.7%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	367	ColorType::channel_count	call site: 00367	ImageReader::decode_into
77	142	ImageLayout::total_bytes	call site: 00142	Orientation::locate_orientation_entry
76	223	MetadataBlock::get	call site: 00223	ImageReader::decode_into
57	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
54	458	MetadataBlock::get	call site: 00458	ImageReader::decode_to_dynimage
45	673	Orientation::from_exif_chunk	call site: 00673	rotate90_in
29	90	ImageReader::fill_header_metadata_if_any	call site: 00090	ImageReader::decode_into
22	56	ImageBuffer::image_buffer_len	call site: 00056	ReferenceTestCase::from_str
21	561	decoder_to_image	call site: 00561	ImageReader::decode_into
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
16	19	ImageReaderOptions::set_format	call site: 00019

Runtime coverage analysis

Covered functions

439

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_png.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_tiff

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	630	85.0%
gold	[1:9]	12	1.61%
yellow	[10:29]	24	3.23%
greenyellow	[30:49]	4	0.53%
lawngreen	50+	71	9.58%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	367	ColorType::channel_count	call site: 00367	ImageReader::decode_into
79	220	MetadataBlock::get	call site: 00220	ImageReader::decode_into
57	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
55	142	ImageLayout::total_bytes	call site: 00142	Orientation::locate_orientation_entry
38	474	DecodedImageMetadata::access_block_with	call site: 00474	ImageReader::decode_to_dynimage
29	90	ImageReader::fill_header_metadata_if_any	call site: 00090	ImageReader::decode_into
28	690	DynamicImage::apply_orientation	call site: 00690	rotate270_in
22	56	ImageBuffer::image_buffer_len	call site: 00056	ReferenceTestCase::from_str
21	561	decoder_to_image	call site: 00561	ImageReader::decode_into
20	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
19	200	Orientation::from_exif	call site: 00200	TgaDecoder::expand_color_map

Runtime coverage analysis

Covered functions

791

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_tiff.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_hdr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	637	85.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	14.0%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
157	142	ImageLayout::total_bytes	call site: 00142	ImageReader::decode_into
65	653	DecodedImageMetadata::apply_metdata	call site: 00653	Orientation::locate_orientation_entry
60	307	Limits::check_dimensions	call site: 00307	ImageReader::decode_into
57	373	limit_string_len	call site: 00373	ImageReader::decode_into
40	434	ImageLayout::total_bytes_overflows_u64	call site: 00434	ImageReader::decode_into
37	475	DecodedImageMetadata::access_block_with	call site: 00475	ImageReader::decode_to_dynimage
37	560	ImageBuffer::from_raw	call site: 00560	ImageReader::decode_into
20	56	ImageBuffer::image_buffer_len	call site: 00056	ReferenceTestCase::from_str
20	99	&RgbaImage::len	call site: 00099	ImageReader::fill_header_metadata_if_any
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
18	632	DecodedImageMetadata::exif_metadata	call site: 00632	Moxcms::parse_icc

Runtime coverage analysis

Covered functions

101

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_hdr.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_tga

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	323	72.0%
gold	[1:9]	20	4.46%
yellow	[10:29]	4	0.89%
greenyellow	[30:49]	8	1.78%
lawngreen	50+	93	20.7%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
71	87	ImageLayout::total_bytes	call site: 00087	Orientation::locate_orientation_entry
63	182	TgaDecoder::expand_color_map	call site: 00182	overlay_bounds_ext
44	290	TgaDecoder::expand_color_map	call site: 00290	ImageReader::decode_into
35	29	DecodingError::new	call site: 00029	ImageReader::decode_into
23	250	TgaDecoder::expand_color_map	call site: 00250	ImageReader::fill_header_metadata_if_any
20	159	TgaDecoder::expand_color_map	call site: 00159
18	65	ImageLayout::total_bytes	call site: 00065	Enlargeable::clamp_from
14	351	image::codecs::tga::TgaDecoder::new	call site: 00351	ImageReader::fill_header_metadata_if_any
8	395	R::read_exact_vec	call site: 00395	ImageReader::decode_into
5	275	TgaDecoder::expand_color_map	call site: 00275
5	411	R::read_exact_vec	call site: 00411
3	368	image::codecs::tga::TgaDecoder::new	call site: 00368	ImageReader::decode_into

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

2

Reachable functions

8

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_tga.rs	2
tests/limits_anim.rs	6
src/hooks.rs	40
src/codecs/tga/header.rs	5
src/images/flat.rs	2
src/io/image_reader_type.rs	27
src/io/decoder.rs	3
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io.rs	13
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	10
src/codecs/tga/decoder.rs	13
src/images/buffer.rs	10
src/images/buffer_par.rs	3
src/imageops/mod.rs	11
src/images/generic_image.rs	2
src/error.rs	1
src/io/limits.rs	5
src/codecs/openexr.rs	4

Fuzzer: fuzzer_script_jpeg

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	533	71.9%
gold	[1:9]	11	1.48%
yellow	[10:29]	11	1.48%
greenyellow	[30:49]	2	0.26%
lawngreen	50+	184	24.8%
All colors	741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
59	223	MetadataBlock::get	call site: 00223	overlay_bounds_ext
47	150	PnmHeader::subtype	call site: 00150	Orientation::locate_orientation_entry
46	458	MetadataBlock::get	call site: 00458	Delay::closest_bounded_fraction
29	90	ImageReader::fill_header_metadata_if_any	call site: 00090	ImageReader::decode_into
28	402	ParsedCoreHeader::parse	call site: 00402	ImageReader::decode_into
28	690	DynamicImage::apply_orientation	call site: 00690	rotate270_in
21	343	TgaDecoder::expand_color_map	call site: 00343	Limits::check_layout_dimensions
20	720	ImageReader::decode_to_dynimage	call site: 00720	I::m::a::g::e::R::e::a::d::e::r::::::::i::n::t::o::_::f::r::a::m::e::s::is_end_reached
19	434	ImageLayout::total_bytes_overflows_u64	call site: 00434	ImageReader::decode_into
18	120	ImageLayout::total_bytes	call site: 00120	Enlargeable::clamp_from
16	19	ImageReaderOptions::set_format	call site: 00019
16	673	Orientation::from_exif_chunk	call site: 00673	rotate90_in

Runtime coverage analysis

Covered functions

1853

Functions that are reachable but not covered

1

Reachable functions

2

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_jpeg.rs	2
src/images/dynimage.rs	19
src/hooks.rs	30
src/io/free_functions.rs	15
src/io/image_reader_type.rs	60
tests/limits_anim.rs	7
src/images/buffer.rs	13
src/images/buffer_par.rs	3
tests/metadata.rs	7
tests/reference_images.rs	13
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	1
src/io.rs	3
src/traits.rs	5
src/codecs/pnm/header.rs	6
src/metadata.rs	16
src/codecs/tga/decoder.rs	12
src/imageops/mod.rs	11
src/images/generic_image.rs	3
src/error.rs	1
src/io/limits.rs	6
src/codecs/bmp/decoder.rs	8
src/codecs/farbfeld.rs	14
src/animation.rs	14
src/codecs/avif/encoder.rs	4
tests/regression.rs	2
src/metadata/moxcms.rs	3
src/metadata/cicp.rs	7
src/imageops/affine.rs	10

Fuzzer: fuzzer_script_exr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	499	60.7%
gold	[1:9]	37	4.50%
yellow	[10:29]	11	1.33%
greenyellow	[30:49]	45	5.48%
lawngreen	50+	229	27.8%
All colors	821	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
74	738	ImageReader::set_limits	call site: 00738	ImageReader::decode_into
59	171	MetadataBlock::get	call site: 00171	overlay_bounds_ext
53	80	PnmHeader::subtype	call site: 00080	Orientation::locate_orientation_entry
48	651	gcd	call site: 00651	ImageReader::decode_into
35	602	BmpDecoder::read_headers	call site: 00602	ImageReader::decode_into
34	290	ColorType::channel_count	call site: 00290	ImageReader::decode_into
26	700	Delay::from_numer_denom_ms	call site: 00700	BmpDecoder::read_headers
20	29	ColorType::channel_count	call site: 00029	ImageReader::fill_header_metadata_if_any
18	50	ImageLayout::total_bytes	call site: 00050	Enlargeable::clamp_from
13	234	TgaDecoder::expand_color_map	call site: 00234	ImageReader::decode_into
10	277	TgaDecoder::expand_color_map	call site: 00277	Limits::check_layout_dimensions
8	0	EP	call site: 00000	BmpDecoder::read_headers

Runtime coverage analysis

Covered functions

1853

Functions that are reachable but not covered

5

Reachable functions

8

Percentage of reachable functions covered

37.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_exr.rs	16
src/codecs/tiff.rs	6
src/codecs/openexr.rs	35
src/hooks.rs	20
src/codecs/bmp/decoder.rs	63
src/io/image_reader_type.rs	28
src/io/decoder.rs	3
src/images/flat.rs	1
src/codecs/hdr/decoder.rs	7
src/color.rs	10
src/io.rs	3
src/traits.rs	10
src/codecs/pnm/header.rs	6
src/metadata.rs	10
src/codecs/tga/decoder.rs	12
src/images/buffer.rs	10
src/images/buffer_par.rs	3
src/imageops/mod.rs	11
src/images/generic_image.rs	2
src/error.rs	1
src/io/limits.rs	5
src/codecs/farbfeld.rs	13
src/animation.rs	16
src/utils/mod.rs	3

Fuzzer: fuzzer_script_guess

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	511	83.3%
gold	[1:9]	1	0.16%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.32%
lawngreen	50+	99	16.1%
All colors	613	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
65	494	Header::from_reader	call site: 00494	ImageReader::decode_into
59	194	MetadataBlock::get	call site: 00194	overlay_bounds_ext
48	381	gcd	call site: 00381	ImageReader::decode_into
47	109	PnmHeader::subtype	call site: 00109	Orientation::locate_orientation_entry
45	430	Delay::from_numer_denom_ms	call site: 00430	Header::from_reader
37	0	EP	call site: 00000	ImageReaderOptions::with_guessed_format
29	49	ImageReader::fill_header_metadata_if_any	call site: 00049	ImageReader::decode_into
25	353	limit_string_len	call site: 00353	GifEncoder::set_repeat
21	314	TgaDecoder::expand_color_map	call site: 00314	Limits::check_layout_dimensions
18	79	ImageLayout::total_bytes	call site: 00079	Enlargeable::clamp_from
14	283	TgaDecoder::expand_color_map	call site: 00283	ImageReader::fill_header_metadata_if_any
13	257	TgaDecoder::expand_color_map	call site: 00257	ImageReader::decode_into

Runtime coverage analysis

Covered functions

1853

Functions that are reachable but not covered

2

Reachable functions

2

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzzers/fuzzer_script_guess.rs	2
src/images/dynimage.rs	4
src/hooks.rs	54
src/io/image_reader_type.rs	38
src/codecs/hdr/decoder.rs	7
src/color.rs	5
src/io/decoder.rs	3
src/images/flat.rs	2
src/io.rs	13
src/traits.rs	10
src/codecs/pnm/header.rs	6
src/metadata.rs	10
src/codecs/tga/decoder.rs	13
src/images/buffer.rs	10
src/images/buffer_par.rs	3
src/imageops/mod.rs	11
src/images/generic_image.rs	2
src/error.rs	1
src/io/limits.rs	5
src/codecs/gif.rs	6
src/animation.rs	16
src/io/free_functions.rs	10
tests/limits_anim.rs	7
src/codecs/tga/header.rs	5
src/codecs/openexr.rs	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

5 / 1743

Cyclomatic complexity statically reachable by fuzzers

13 / 2329

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/fuzzers/fuzzer_script_gif.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Limits::check_dimensions', 'ImageLayout::total_bytes', 'MetadataBlock::get', 'DecodedImageMetadata::apply_metdata', 'ImageReader::fill_header_metadata_if_any', 'DecodedImageMetadata::access_block_with', 'decoder_to_image', 'ImageBuffer::from_raw', 'ImageReader::decode_to_dynimage', 'ImageBuffer::subpixels_mut']

fuzz/fuzzers/fuzzer_script_pnm.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['PnmHeader::subtype', 'Limits::check_dimensions', 'DecodedImageMetadata::apply_metdata', 'ImageLayout::total_bytes_overflows_u64', 'DecodedImageMetadata::access_block_with', 'ImageDecoder::format_attributes', 'ImageBuffer::image_buffer_len', 'decoder_to_image', 'ImageReader::decode_to_dynimage', 'ImageLayout::total_bytes']

fuzz/fuzzers/roundtrip_webp.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ImageReader::set_limits', 'MetadataBlock::get', 'Limits::check_dimensions', 'ImageLayout::total_bytes', 'DecodedImageMetadata::apply_metdata', 'ImageReader::fill_header_metadata_if_any', 'decoder_to_image', 'ImageBuffer::from_raw']

fuzz/fuzzers/fuzzer_script_bmp.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ImageLayout::total_bytes', 'ParsedCoreHeader::parse', 'Limits::check_dimensions', 'DecodedImageMetadata::apply_metdata', 'DecodedImageMetadata::access_block_with', 'ImageReader::fill_header_metadata_if_any', 'decoder_to_image', 'ImageBuffer::image_buffer_len', 'ImageReader::decode_to_dynimage']

fuzz/fuzzers/fuzzer_script_webp.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Limits::check_dimensions', 'ImageLayout::total_bytes', 'Orientation::from_exif_chunk', 'MetadataBlock::get', 'decoder_to_image', 'ImageReader::fill_header_metadata_if_any', 'ImageBuffer::image_buffer_len']

fuzz/fuzzers/fuzzer_script_ico.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MetadataBlock::get', 'ImageLayout::total_bytes', 'DecodedImageMetadata::apply_metdata', 'Box::read_image', 'ParsedCoreHeader::parse', 'DecodedImageMetadata::access_block_with', 'ImageBuffer::check_image_fits', 'ImageReader::fill_header_metadata_if_any', 'ImageBuffer::image_buffer_len', 'ImageReader::decode_to_dynimage']

fuzz/fuzzers/fuzzer_script_png.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ColorType::channel_count', 'ImageLayout::total_bytes', 'MetadataBlock::get', 'Limits::check_dimensions', 'Orientation::from_exif_chunk', 'ImageReader::fill_header_metadata_if_any', 'ImageBuffer::image_buffer_len', 'decoder_to_image', 'ImageReader::decode_to_dynimage']

fuzz/fuzzers/fuzzer_script_tiff.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ColorType::channel_count', 'MetadataBlock::get', 'Limits::check_dimensions', 'ImageLayout::total_bytes', 'DecodedImageMetadata::access_block_with', 'ImageReader::fill_header_metadata_if_any', 'DynamicImage::apply_orientation', 'ImageBuffer::image_buffer_len', 'decoder_to_image', 'DecodedImageMetadata::apply_metdata']

fuzz/fuzzers/fuzzer_script_hdr.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ImageLayout::total_bytes', 'DecodedImageMetadata::apply_metdata', 'Limits::check_dimensions', 'limit_string_len', 'ImageLayout::total_bytes_overflows_u64', 'DecodedImageMetadata::access_block_with', 'ImageBuffer::from_raw', 'ImageBuffer::image_buffer_len', '&RgbaImage::len', 'ImageReader::decode_to_dynimage']

fuzz/fuzzers/fuzzer_script_tga.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ImageLayout::total_bytes', 'TgaDecoder::expand_color_map', 'DecodingError::new', 'image::codecs::tga::TgaDecoder::new', 'R::read_exact_vec']

fuzz/fuzzers/fuzzer_script_jpeg.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['MetadataBlock::get', 'PnmHeader::subtype', 'ImageReader::fill_header_metadata_if_any', 'ParsedCoreHeader::parse', 'DynamicImage::apply_orientation', 'TgaDecoder::expand_color_map', 'ImageReader::decode_to_dynimage', 'ImageLayout::total_bytes_overflows_u64', 'ImageLayout::total_bytes']

fuzz/fuzzers/fuzzer_script_exr.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ImageReader::set_limits', 'MetadataBlock::get', 'PnmHeader::subtype', 'gcd', 'BmpDecoder::read_headers', 'ColorType::channel_count', 'Delay::from_numer_denom_ms', 'ImageLayout::total_bytes', 'TgaDecoder::expand_color_map']

fuzz/fuzzers/fuzzer_script_guess.rs

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Header::from_reader', 'MetadataBlock::get', 'gcd', 'PnmHeader::subtype', 'Delay::from_numer_denom_ms', 'ImageReader::fill_header_metadata_if_any', 'limit_string_len', 'TgaDecoder::expand_color_map', 'ImageLayout::total_bytes']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
image::metadata::moxcms::Moxcms as image::metadata::CmsProvider::parse_icc	53	4	7.547%
image_webp::encoder::WebPEncoder&mut std::io::cursor::Cursoralloc::vec::Vecu8::encode	61	19	31.14%
image::color::ExtendedColorType::bits_per_pixel	35	4	11.42%
u32 as core::convert::Frommoxcms::tag::Tag::from	33	13	39.39%
moxcms::profile::ColorProfile::encode	207	112	54.10%
moxcms::writer::write_trc_entry	37	19	51.35%
moxcms::profile::ColorProfile::read_string_tag	100	52	52.0%
tiff::decoder::invert_colors	40	21	52.5%
tiff::decoder::rev_hpredict_nsamp	52	20	38.46%
zune_jpeg::worker::color_convert	72	27	37.5%

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
/src/image/tests/metadata.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	[]
/src/image/src/codecs/gif.rs	['fuzzer_script_guess']	['fuzzer_script_guess']
/src/image/benches/copy_from.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_guess.rs	['fuzzer_script_guess']	[]
/src/image/src/io/limits.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/utils/mod.rs	['fuzzer_script_exr']	['fuzzer_script_exr']
/src/image/tests/bad_images.rs	[]	[]
/src/image/tests/limits_anim.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_guess']	[]
/src/image/src/images/buffer.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/benches/encode.rs	[]	[]
/src/image/src/metadata.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_webp', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/jpeg/encoder.rs	[]	[]
/src/image/src/animation.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/avif/ycgco.rs	[]	[]
/src/image/src/math/rect.rs	[]	[]
/src/image/benches/convert.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_bmp.rs	['fuzzer_script_bmp']	[]
/src/image/tests/regression.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	[]
/src/image/src/images/flat.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/traits.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['roundtrip_webp', 'fuzzer_script_webp', 'fuzzer_script_tiff', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/lib.rs	[]	[]
/src/image/src/codecs/ico/encoder.rs	[]	[]
/src/image/src/io/format.rs	[]	[]
/src/image/src/codecs/ico/decoder.rs	[]	[]
/src/image/src/imageops/colorops.rs	[]	[]
/src/image/benches/bgra_to_rgba.rs	[]	[]
/src/image/fuzz-afl/reproducers/reproduce_webp.rs	[]	[]
/src/image/src/codecs/pnm/encoder.rs	[]	[]
/src/image/src/imageops/fast_blur.rs	[]	[]
/src/image/src/imageops/mod.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	[]
/src/image/src/imageops/affine.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	['fuzzer_script_tiff', 'fuzzer_script_jpeg']
/src/image/tests/conversions.rs	[]	[]
/src/image/src/codecs/hdr/decoder.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/fuzz/fuzzers/fuzzer_script_webp.rs	['fuzzer_script_webp']	[]
/src/image/tests/truncate_images.rs	[]	[]
/src/image/src/codecs/avif/decoder.rs	[]	[]
/src/image/examples/scaledown/main.rs	[]	[]
/src/image/src/codecs/bmp/decoder.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr']
/src/image/src/images/sub_image.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_jpeg.rs	['fuzzer_script_jpeg']	[]
/src/image/src/io/free_functions.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_guess']	[]
/src/image/src/codecs/hdr/encoder.rs	[]	[]
/src/image/tests/limits.rs	[]	[]
/src/image/tests/reference_images.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	[]
/src/image/src/codecs/webp/encoder.rs	[]	[]
/src/image/src/primitive_sealed.rs	[]	[]
/src/image/src/codecs/qoi.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_tiff.rs	['fuzzer_script_tiff']	[]
/src/image/src/imageops/sample.rs	[]	[]
/src/image/src/error.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/pnm/header.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/tests/save_jpeg.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_gif.rs	['fuzzer_script_gif']	[]
/src/image/src/images/dynimage.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_guess']
/src/image/src/codecs/webp/decoder.rs	[]	[]
/src/image/src/math/utils.rs	[]	[]
/src/image/src/codecs/pnm/autobreak.rs	[]	[]
/src/image/fuzz-afl/reproducers/utils.rs	[]	[]
/src/image/src/codecs/jpeg/decoder.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_hdr.rs	['fuzzer_script_hdr']	[]
/src/image/src/codecs/pnm/mod.rs	[]	[]
/src/image/fuzz/fuzzers/roundtrip_webp.rs	['roundtrip_webp']	[]
/src/image/src/io/image_reader_type.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/bmp/encoder.rs	[]	[]
/src/image/src/io.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/color.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/openexr.rs	['fuzzer_script_tga', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_tga', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/tga/decoder.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/codecs/tga/header.rs	['roundtrip_webp', 'fuzzer_script_tga', 'fuzzer_script_guess']	['roundtrip_webp', 'fuzzer_script_tga', 'fuzzer_script_guess']
/src/image/benches/decode.rs	[]	[]
/src/image/src/imageops/filter_1d.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_ico.rs	['fuzzer_script_ico']	[]
/src/image/src/codecs/pnm/decoder.rs	[]	[]
/src/image/src/codecs/avif/yuv.rs	[]	[]
/src/image/benches/blur.rs	[]	[]
/src/image/examples/concat/main.rs	[]	[]
/src/image/src/io/encoder.rs	[]	[]
/src/image/src/metadata/moxcms.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	['fuzzer_script_gif', 'roundtrip_webp', 'fuzzer_script_webp', 'fuzzer_script_png', 'fuzzer_script_jpeg']
/src/image/src/codecs/farbfeld.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr']
/src/image/fuzz/fuzzers/fuzzer_script_exr.rs	['fuzzer_script_exr']	[]
/src/image/fuzz/fuzzers/fuzzer_script_png.rs	['fuzzer_script_png']	[]
/src/image/src/codecs/tga/encoder.rs	[]	[]
/src/image/src/imageops/resize.rs	[]	[]
/src/image/src/codecs/png.rs	[]	[]
/src/image/fuzz/fuzzers/fuzzer_script_tga.rs	['fuzzer_script_tga']	['fuzzer_script_tga']
/src/image/src/codecs/avif/encoder.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']
/src/image/src/codecs/tiff.rs	['fuzzer_script_exr']	['fuzzer_script_exr']
/src/image/src/images/generic_image.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/hooks.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/src/images/buffer_par.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/fuzz/fuzzers/fuzzer_script_pnm.rs	['fuzzer_script_pnm']	[]
/src/image/tests/save_pnm.rs	[]	[]
/src/image/src/io/decoder.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_tga', 'fuzzer_script_jpeg', 'fuzzer_script_exr', 'fuzzer_script_guess']
/src/image/fuzz-afl/reproducers/reproduce_pnm.rs	[]	[]
/src/image/src/metadata/cicp.rs	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']	['fuzzer_script_gif', 'fuzzer_script_pnm', 'roundtrip_webp', 'fuzzer_script_bmp', 'fuzzer_script_webp', 'fuzzer_script_ico', 'fuzzer_script_png', 'fuzzer_script_tiff', 'fuzzer_script_hdr', 'fuzzer_script_jpeg']
/src/image/benches/imageops.rs	[]	[]

Directories in report

Directory
/src/image/src/codecs/tga/
/src/image/src/codecs/
/src/image/src/codecs/hdr/
/src/image/src/utils/
/src/image/src/metadata/
/src/image/src/codecs/avif/
/src/image/benches/
/src/image/src/math/
/src/image/fuzz-afl/reproducers/
/src/image/src/codecs/webp/
/src/image/src/codecs/pnm/
/src/image/src/imageops/
/src/image/src/codecs/ico/
/src/image/src/
/src/image/src/images/
/src/image/src/codecs/bmp/
/src/image/fuzz/fuzzers/
/src/image/examples/scaledown/
/src/image/src/io/
/src/image/src/codecs/jpeg/
/src/image/tests/
/src/image/examples/concat/

This section shows a list of 3rd party function calls and their relative coverage information. By static analysis of the target project code, all of the 3rd party function call and their caller information, including the source file and line number that initiate the call are captured. The caller source code file and line number are shown in column 2 while column 1 is the function name of the 3rd party function call. Each occurrent of the 3rd party function call will occuply a separate row. Column 3 of each row indicate if the 3rd party call in the source file line is unreachable. Column 4 lists all fuzzers that have covered that particular system call in that specific location (source file and line)during their dynamic fuzzing.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Covered by Fuzzers