High level conclusions

Fuzzers reach 25.70% of cyclomatic complexity.

Fuzzers reach 30.94% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

427 / 1380

Cyclomatic complexity statically reachable by fuzzers

2737 / 10649

Runtime code coverage of functions

380 / 1380

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: jq_fuzz_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	283	56.5%
gold	[1:9]	14	2.80%
yellow	[10:29]	1	0.2%
greenyellow	[30:49]	5	1.0%
lawngreen	50+	197	39.4%
All colors	500	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
70	239	5 : View List ['decSetOverflow', 'decCompare', 'decNumberZero', 'decShiftToMost', 'decApplyRound']	70	360	decFinalize	call site: 00150	/src/jq/src/decNumber/decNumber.c:7289
25	195	8 : View List ['jv_invalid', 'jv_is_valid.199', 'parse_is_top_num', 'parser_reset', 'jv_free', 'seq_check_truncation', 'stream_seq_check_truncation', 'stream_is_top_num']	227	1215	scan	call site: 00128	/src/jq/src/jv_parse.c:648
2	2	1 : View List ['decSetMaxValue']	2	2	decSetOverflow	call site: 00155	/src/jq/src/decNumber/decNumber.c:7378
2	2	1 : View List ['abort']	2	2	jv_tsd_dec_ctx_init	call site: 00247	/src/jq/src/jv.c:512
2	2	1 : View List ['abort']	2	2	tsd_dec_ctx_get	call site: 00263	/src/jq/src/jv.c:542
0	372	3 : View List ['jv_array', 'jv_array_append', 'jv_copy']	0	621	jv_parser_next	call site: 00464	/src/jq/src/jv_parse.c:848
0	372	3 : View List ['jv_array', 'jv_array_append', 'jv_copy']	0	372	make_error	call site: 00440	/src/jq/src/jv_parse.c:760
0	245	2 : View List ['make_error', 'jv_free']	0	245	jv_parser_next	call site: 00466	/src/jq/src/jv_parse.c:854
0	170	9 : View List ['jvp_object_ptr', 'jvp_object_buckets', 'jvp_refcnt_unshared', 'jvp_object_get_slot', 'jvp_object_free', 'jv_get_kind', 'jvp_object_size', 'jvp_object_new', 'jv_copy']	0	170	jvp_object_unshare	call site: 00000	/src/jq/src/jv.c:1635
0	113	2 : View List ['jv_string', 'jv_invalid_with_msg']	0	245	jv_array_set	call site: 00210	/src/jq/src/jv.c:995
0	41	1 : View List ['jv_array']	0	309	parser_reset	call site: 00057	/src/jq/src/jv_parse.c:99
0	41	1 : View List ['jv_array']	0	47	parser_init	call site: 00004	/src/jq/src/jv_parse.c:71

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

74

Reachable functions

184

Percentage of reachable functions covered

59.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/jq_fuzz_parse.c	1
src/jv_parse.c	18
src/jv.c	52
src/jv_alloc.c	8
src/jv_dtoa.c	24
src/jv_unicode.c	4
./src/jv.h	1
src/decNumber/decContext.c	3
src/decNumber/decNumber.c	24
src/jv_dtoa_tsd.c	4

Fuzzer: jq_fuzz_load_file

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	288	54.7%
gold	[1:9]	14	2.66%
yellow	[10:29]	2	0.38%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	222	42.2%
All colors	526	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	186	3 : View List ['jv_string_fmt', 'jv_free', 'jv_invalid_with_msg']	85	186	jv_load_file	call site: 00511	/src/jq/src/jv_file.c:75
70	239	5 : View List ['decSetOverflow', 'decCompare', 'decNumberZero', 'decShiftToMost', 'decApplyRound']	70	360	decFinalize	call site: 00196	/src/jq/src/decNumber/decNumber.c:7289
25	195	8 : View List ['jv_invalid', 'jv_is_valid.199', 'parse_is_top_num', 'parser_reset', 'jv_free', 'seq_check_truncation', 'stream_seq_check_truncation', 'stream_is_top_num']	227	1215	scan	call site: 00174	/src/jq/src/jv_parse.c:648
2	2	1 : View List ['decSetMaxValue']	2	2	decSetOverflow	call site: 00201	/src/jq/src/decNumber/decNumber.c:7378
2	2	1 : View List ['abort']	2	2	jv_tsd_dec_ctx_init	call site: 00292	/src/jq/src/jv.c:512
2	2	1 : View List ['abort']	2	2	tsd_dec_ctx_get	call site: 00308	/src/jq/src/jv.c:542
0	372	3 : View List ['jv_array', 'jv_array_append', 'jv_copy']	0	621	jv_parser_next	call site: 00502	/src/jq/src/jv_parse.c:848
0	372	3 : View List ['jv_array', 'jv_array_append', 'jv_copy']	0	372	make_error	call site: 00483	/src/jq/src/jv_parse.c:760
0	245	2 : View List ['make_error', 'jv_free']	0	245	jv_parser_next	call site: 00504	/src/jq/src/jv_parse.c:854
0	170	9 : View List ['jvp_object_ptr', 'jvp_object_buckets', 'jvp_refcnt_unshared', 'jvp_object_get_slot', 'jvp_object_free', 'jv_get_kind', 'jvp_object_size', 'jvp_object_new', 'jv_copy']	0	170	jvp_object_unshare	call site: 00000	/src/jq/src/jv.c:1635
0	113	2 : View List ['jv_string', 'jv_invalid_with_msg']	0	245	jv_array_set	call site: 00256	/src/jq/src/jv.c:995
0	41	1 : View List ['jv_array']	0	309	parser_reset	call site: 00142	/src/jq/src/jv_parse.c:99

Runtime coverage analysis

Covered functions

114

Functions that are reachable but not covered

90

Reachable functions

204

Percentage of reachable functions covered

55.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/jq_fuzz_load_file.c	1
src/jv_file.c	1
src/jv.c	57
src/jv_alloc.c	8
src/jv_unicode.c	5
src/jv_parse.c	18
src/jv_dtoa.c	24
./src/jv.h	1
src/decNumber/decContext.c	3
src/decNumber/decNumber.c	24
src/jv_dtoa_tsd.c	4

Fuzzer: jq_fuzz_compile

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	931	44.1%
gold	[1:9]	57	2.70%
yellow	[10:29]	30	1.42%
greenyellow	[30:49]	2	0.09%
lawngreen	50+	1089	51.6%
All colors	2109	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
397	397	1 : View List ['put_refcnt']	397	611	jv_dump_term	call site: 00197	/src/jq/src/jv_print.c:254
397	397	1 : View List ['put_refcnt']	397	611	jv_dump_term	call site: 00197	/src/jq/src/jv_print.c:285
397	397	1 : View List ['put_refcnt']	397	611	jv_dump_term	call site: 00197	/src/jq/src/jv_print.c:357
205	273	5 : View List ['stack_pop_block', 'jv_array_slice', 'jv_get_kind', 'stack_block', 'jv_free']	205	273	stack_restore	call site: 00587	/src/jq/src/execute.c:284
151	151	1 : View List ['put_indent']	548	1202	jv_dump_term	call site: 00197	/src/jq/src/jv_print.c:279
151	151	1 : View List ['put_indent']	548	1202	jv_dump_term	call site: 00197	/src/jq/src/jv_print.c:351
28	72	2 : View List ['decUnitCompare', 'decNaNs']	28	282	decCompareOp	call site: 01327	/src/jq/src/decNumber/decNumber.c:6051
25	195	8 : View List ['jv_invalid', 'jv_is_valid.199', 'parse_is_top_num', 'parser_reset', 'jv_free', 'seq_check_truncation', 'stream_seq_check_truncation', 'stream_is_top_num']	227	1215	scan	call site: 00755	/src/jq/src/jv_parse.c:648
8	10	2 : View List ['decNumberZero', 'decBiStr']	8	408	decNumberFromString	call site: 00772	/src/jq/src/decNumber/decNumber.c:527
2	2	1 : View List ['decSetMaxValue']	2	2	decSetOverflow	call site: 00258	/src/jq/src/decNumber/decNumber.c:7378
2	2	1 : View List ['abort']	2	2	jv_tsd_dec_ctx_init	call site: 00226	/src/jq/src/jv.c:512
2	2	1 : View List ['abort']	2	2	tsd_dec_ctx_get	call site: 00243	/src/jq/src/jv.c:542

Runtime coverage analysis

Covered functions

375

Functions that are reachable but not covered

101

Reachable functions

474

Percentage of reachable functions covered

78.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/jq_fuzz_compile.c	1
src/execute.c	23
src/jv_alloc.c	11
./src/exec_stack.h	7
src/jv.c	94
src/jv_print.c	9
src/jv_unicode.c	5
src/jv_dtoa_tsd.c	4
src/jv_dtoa.c	29
src/decNumber/decNumber.c	26
src/decNumber/decContext.c	3
src/jv_aux.c	4
src/locfile.c	6
./src/jv.h	1
src/bytecode.c	4
src/linker.c	9
src/parser.y	14
src/lexer.c	23
src/lexer.l	5
src/compile.c	70
src/parser.c	6
src/jv_parse.c	19
src/builtin.c	16
src/util.c	4
src/jv_file.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
f_match	/src/jq/src/builtin.c	7	['struct.jq_state *', 'size_t', 'struct.jv_refcnt *', 'size_t', 'struct.jv_refcnt *', 'struct.jv *', 'struct.jv *']	16	0	2358	91	26	614	0	6137	4802
decNumberPower	/src/jq/src/decNumber/decNumber.c	4	['struct.decNumber *', 'struct.decNumber *', 'struct.decNumber *', 'struct.decContext *']	8	0	1068	161	60	34	0	776	418
jq_next	/src/jq/src/execute.c	1	['struct.jq_state *']	18	0	4254	256	54	235	0	1588	188
onig_regset_search	/src/jq/modules/oniguruma/src/regexec.c	8	['struct.OnigRegSetStruct *', 'char *', 'char *', 'char *', 'char *', 'int', 'int', 'int *']	11	0	143	14	5	45	0	1050	106
onig_setup_builtin_monitors_by_ascii_encoded_name	/src/jq/modules/oniguruma/src/regexec.c	1	['char *']	6	0	82	11	4	34	0	184	100
f_delpaths	/src/jq/src/builtin.c	5	['struct.jq_state *', 'size_t', 'struct.jv_refcnt *', 'size_t', 'struct.jv_refcnt *']	20	0	49	3	2	187	0	1281	93
get_case_fold_codes_by_str	/src/jq/modules/oniguruma/src/utf8.c	4	['int', 'char *', 'char *', 'struct.OnigCaseFoldCodeItem *']	4	0	28	3	2	8	0	91	79
detect_can_be_slow	/src/jq/modules/oniguruma/src/regcomp.c	4	['struct._Node *', 'struct.SlowElementCount *', 'int', 'int *']	3	0	650	102	28	2	2	74	74
jq_util_input_next_input_cb	/src/jq/src/util.c	2	['struct.jq_state *', 'char *']	17	0	30	3	2	194	0	1362	55
f_format	/src/jq/src/builtin.c	5	['struct.jq_state *', 'size_t', 'struct.jv_refcnt *', 'size_t', 'struct.jv_refcnt *']	16	0	1837	140	40	180	0	1278	51

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

929 / 1380

Cyclomatic complexity statically reachable by fuzzers

8665 / 10649

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
decContextDefault	39	21	53.84%	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
decApplyRound	94	36	38.29%	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
decCompareOp	91	23	25.27%	['jq_fuzz_compile']
jvp_dtoa	273	120	43.95%	['jq_fuzz_compile']
yy_get_next_buffer	90	19	21.11%	['jq_fuzz_compile']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/jq/src/bytecode.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/util.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/tests/jq_fuzz_compile.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/parser.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/modules/oniguruma/src/regenc.c	[]	[]
/src/jq/./src/libm.h	[]	[]
/src/jq/modules/oniguruma/src/regsyntax.c	[]	[]
/src/jq/modules/oniguruma/src/st.c	[]	[]
/src/jq/src/jv_print.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/builtin.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/tests/jq_fuzz_parse.c	['jq_fuzz_parse']	['jq_fuzz_parse']
/src/jq/src/linker.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/locfile.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/modules/oniguruma/src/regexec.c	[]	[]
/src/jq/src/compile.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/jv_alloc.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/modules/oniguruma/src/regcomp.c	[]	[]
/src/jq/modules/oniguruma/src/regparse.c	[]	[]
/src/jq/src/parser.y	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/src/jv_parse.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/src/jv_aux.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/./src/exec_stack.h	['jq_fuzz_compile']	[]
/src/jq/src/lexer.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/modules/oniguruma/src/unicode.c	[]	[]
/src/jq/modules/oniguruma/src/unicode_fold2_key.c	[]	[]
/src/jq/src/jv.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/src/execute.c	['jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/./src/jv.h	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	[]
/src/jq/src/decNumber/decNumber.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/src/jv_dtoa_tsd.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_compile']
/src/jq/modules/oniguruma/src/./unicode_property_data.c	[]	[]
/src/jq/modules/oniguruma/src/unicode_unfold_key.c	[]	[]
/src/jq/modules/oniguruma/src/regerror.c	[]	[]
/src/jq/src/jv_file.c	['jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_load_file']
/src/jq/modules/oniguruma/src/utf8.c	[]	[]
/src/jq/src/jv_dtoa.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/modules/oniguruma/src/unicode_fold3_key.c	[]	[]
/src/jq/src/jv_unicode.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/modules/oniguruma/src/ascii.c	[]	[]
/src/jq/tests/jq_fuzz_load_file.c	['jq_fuzz_load_file']	['jq_fuzz_load_file']
/src/jq/src/decNumber/decContext.c	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']	['jq_fuzz_parse', 'jq_fuzz_load_file', 'jq_fuzz_compile']
/src/jq/modules/oniguruma/src/unicode_fold1_key.c	[]	[]
/src/jq/src/lexer.l	['jq_fuzz_compile']	['jq_fuzz_compile']

Directories in report

Directory
/src/jq/src/
/src/jq/modules/oniguruma/src/./
/src/jq/src/decNumber/
/src/jq/modules/oniguruma/src/
/src/jq/tests/
/src/jq/./src/