Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Report generation date: 2024-06-18

Project overview: leptonica

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
51.0%
3313 / 6521
Cyclomatic complexity statically reachable by fuzzers
56.0%
37043 / 66372
Runtime code coverage of functions
32.0%
2091 / 6521

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
bilinear_fuzzer /src/leptonica/prog/fuzzing/bilinear_fuzzer.cc 1125 5268 24 143 29053 10382 bilinear_fuzzer.cc
ccbord_fuzzer /src/leptonica/prog/fuzzing/ccbord_fuzzer.cc 218 6163 12 25 6601 2435 ccbord_fuzzer.cc
boxfunc3_fuzzer /src/leptonica/prog/fuzzing/boxfunc3_fuzzer.cc 2154 4227 24 256 52724 19316 boxfunc3_fuzzer.cc
morphapp_fuzzer /src/leptonica/prog/fuzzing/morphapp_fuzzer.cc 2128 4253 24 251 53120 19421 morphapp_fuzzer.cc
morph_fuzzer /src/leptonica/prog/fuzzing/morph_fuzzer.cc 1241 5140 24 143 30139 10821 morph_fuzzer.cc
adaptmap_fuzzer /src/leptonica/prog/fuzzing/adaptmap_fuzzer.cc 2113 4268 24 251 53129 19408 adaptmap_fuzzer.cc
compare_fuzzer /src/leptonica/prog/fuzzing/compare_fuzzer.cc 2005 4376 27 240 49012 17909 compare_fuzzer.cc
pageseg_fuzzer /src/leptonica/prog/fuzzing/pageseg_fuzzer.cc 1815 4566 28 210 45003 16729 pageseg_fuzzer.cc
pixa_recog_fuzzer /src/leptonica/prog/fuzzing/pixa_recog_fuzzer.cc 2328 4153 27 264 58968 21618 pixa_recog_fuzzer.cc
baseline_fuzzer /src/leptonica/prog/fuzzing/baseline_fuzzer.cc 2112 4273 25 254 51852 18965 baseline_fuzzer.cc
pix_orient_fuzzer /src/leptonica/prog/fuzzing/pix_orient_fuzzer.cc 1563 4824 24 190 36476 13493 pix_orient_fuzzer.cc
colorfill_fuzzer /src/leptonica/prog/fuzzing/colorfill_fuzzer.cc 66 6328 8 15 1150 475 colorfill_fuzzer.cc
affine_fuzzer /src/leptonica/prog/fuzzing/affine_fuzzer.cc 1198 5183 24 150 31653 11336 affine_fuzzer.cc
blend_fuzzer /src/leptonica/prog/fuzzing/blend_fuzzer.cc 1158 5223 24 148 31202 11121 blend_fuzzer.cc
recog_basic_fuzzer /src/leptonica/prog/fuzzing/recog_basic_fuzzer.cc 2200 4282 27 259 54195 19847 recog_basic_fuzzer.cc
dewarp_fuzzer /src/leptonica/prog/fuzzing/dewarp_fuzzer.cc 2337 4110 31 270 60198 22081 dewarp_fuzzer.cc
paintcmap_fuzzer /src/leptonica/prog/fuzzing/paintcmap_fuzzer.cc 78 6303 9 12 1408 577 paintcmap_fuzzer.cc
boxfunc4_fuzzer /src/leptonica/prog/fuzzing/boxfunc4_fuzzer.cc 1370 5011 25 167 36883 13309 boxfunc4_fuzzer.cc
graphics_fuzzer /src/leptonica/prog/fuzzing/graphics_fuzzer.cc 1221 5160 24 153 31741 11400 graphics_fuzzer.cc
flipdetect_fuzzer /src/leptonica/prog/fuzzing/flipdetect_fuzzer.cc 1565 4822 23 190 36543 13518 flipdetect_fuzzer.cc
mask_fuzzer /src/leptonica/prog/fuzzing/mask_fuzzer.cc 1599 4784 23 192 38458 14213 mask_fuzzer.cc
classapp_fuzzer /src/leptonica/prog/fuzzing/classapp_fuzzer.cc 2152 4273 30 255 52449 19227 classapp_fuzzer.cc
edge_fuzzer /src/leptonica/prog/fuzzing/edge_fuzzer.cc 1320 5061 21 169 28996 10725 edge_fuzzer.cc
boxfunc_fuzzer /src/leptonica/prog/fuzzing/boxfunc_fuzzer.cc 1978 4418 32 241 47647 17413 boxfunc_fuzzer.cc
pix4_fuzzer /src/leptonica/prog/fuzzing/pix4_fuzzer.cc 2204 4177 28 255 54881 20138 pix4_fuzzer.cc
fpix2_fuzzer /src/leptonica/prog/fuzzing/fpix2_fuzzer.cc 156 6225 11 19 4318 1565 fpix2_fuzzer.cc
enhance_fuzzer /src/leptonica/prog/fuzzing/enhance_fuzzer.cc 1395 4986 25 165 37916 13709 enhance_fuzzer.cc
pix1_fuzzer /src/leptonica/prog/fuzzing/pix1_fuzzer.cc 45 6336 8 10 759 318 pix1_fuzzer.cc
grayquant_fuzzer /src/leptonica/prog/fuzzing/grayquant_fuzzer.cc 127 6254 9 17 3833 1383 grayquant_fuzzer.cc
checkerboard_fuzzer /src/leptonica/prog/fuzzing/checkerboard_fuzzer.cc 1567 4821 22 196 36810 13636 checkerboard_fuzzer.cc
colorquant_fuzzer /src/leptonica/prog/fuzzing/colorquant_fuzzer.cc 1668 4729 24 195 41280 15277 colorquant_fuzzer.cc
fhmtgen_fuzzer /src/leptonica/prog/fuzzing/fhmtgen_fuzzer.cc 143 6251 11 17 4064 1485 fhmtgen_fuzzer.cc
finditalic_fuzzer /src/leptonica/prog/fuzzing/finditalic_fuzzer.cc 2147 4268 28 259 52405 19193 finditalic_fuzzer.cc
ccthin_fuzzer /src/leptonica/prog/fuzzing/ccthin_fuzzer.cc 1679 4706 21 193 40491 14824 ccthin_fuzzer.cc
graymorph_fuzzer /src/leptonica/prog/fuzzing/graymorph_fuzzer.cc 119 6262 10 14 4038 1442 graymorph_fuzzer.cc
barcode_fuzzer /src/leptonica/prog/fuzzing/barcode_fuzzer.cc 1599 4812 23 197 38122 14121 barcode_fuzzer.cc
pix3_fuzzer /src/leptonica/prog/fuzzing/pix3_fuzzer.cc 2117 4264 24 248 52939 19340 pix3_fuzzer.cc
pixconv_fuzzer /src/leptonica/prog/fuzzing/pixconv_fuzzer.cc 1541 4840 24 186 35658 13206 pixconv_fuzzer.cc
boxfunc5_fuzzer /src/leptonica/prog/fuzzing/boxfunc5_fuzzer.cc 1997 4399 32 242 48563 17751 boxfunc5_fuzzer.cc
bilateral_fuzzer /src/leptonica/prog/fuzzing/bilateral_fuzzer.cc 210 6180 19 24 6948 2520 bilateral_fuzzer.cc
pix_rotate_shear_fuzzer /src/leptonica/prog/fuzzing/pix_rotate_shear_fuzzer.cc 1097 5286 22 139 28331 10087 pix_rotate_shear_fuzzer.cc
maze_fuzzer /src/leptonica/prog/fuzzing/maze_fuzzer.cc 124 6262 10 18 3830 1373 maze_fuzzer.cc
kernel_fuzzer /src/leptonica/prog/fuzzing/kernel_fuzzer.cc 50 6331 8 10 906 372 kernel_fuzzer.cc
jpegiostub_fuzzer /src/leptonica/prog/fuzzing/jpegiostub_fuzzer.cc 45 6336 8 10 759 318 jpegiostub_fuzzer.cc
binarize_fuzzer /src/leptonica/prog/fuzzing/binarize_fuzzer.cc 2150 4242 25 254 54357 19869 binarize_fuzzer.cc

Fuzzer details

Fuzzer: bilinear_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 4749 95.8%
gold [1:9] 5 0.10%
yellow [10:29] 5 0.10%
greenyellow [30:49] 2 0.04%
lawngreen 50+ 194 3.91%
All colors 4955 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
9570 9570 2 :

['fclose', 'pixReadStream']

9570 9577 pixRead call site: 00710 /src/leptonica/src/readfile.c:197
2547 4368 9 :

['pixRemoveColormap', 'pixGetDepth', 'pixBilinearSampledPta', 'pixClone', 'pixBilinearPtaGray', 'pixDestroy', 'pixConvertTo8', 'ptaGetCount', 'pixBilinearPtaColor']

2547 4375 pixBilinearPta call site: 00235 /src/leptonica/src/bilinear.c:301
1233 1244 4 :

['getBilinearXformCoeffs', 'free', 'ptaGetCount', 'pixBilinearColor']

1233 1251 pixBilinearPtaColor call site: 00634 /src/leptonica/src/bilinear.c:422
446 457 4 :

['free', 'ptaGetCount', 'getBilinearXformCoeffs', 'pixBilinearGray']

446 464 pixBilinearPtaGray call site: 00612 /src/leptonica/src/bilinear.c:521
98 98 1 :

['rasteropVAlignedLow']

98 98 rasteropLow call site: 00432 /src/leptonica/src/roplow.c:569
31 31 2 :

['strlen', 'stringCat']

31 31 genPathname call site: 00729 /src/leptonica/src/utils2.c:3163
24 24 1 :

['pixSetAll']

24 1500 pixBilinearPtaWithAlpha call site: 04911 /src/leptonica/src/bilinear.c:673
11 11 1 :

['pixcmapGetCount']

11 60 pixSetAllArbitrary call site: 00358 /src/leptonica/src/pix2.c:942
11 11 1 :

['pixClone']

11 11 pixAddBorder call site: 04883 /src/leptonica/src/pix2.c:1791
2 2 1 :

['getcwd']

45 94 genPathname call site: 00713 /src/leptonica/src/utils2.c:3102
0 48 1 :

['pixSetAllArbitrary']

0 420 pixAddBorderGeneral call site: 04890 /src/leptonica/src/pix2.c:1905
0 47 2 :

['returnErrorPtr', 'pixDestroy']

0 47 pixCreateNoInit call site: 00065 /src/leptonica/src/pix1.c:355

Runtime coverage analysis

Covered functions
88
Functions that are reachable but not covered
1036
Reachable functions
1125
Percentage of reachable functions covered
7.91%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/bilinear_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 7
/src/leptonica/src/spixio.c 3
/src/leptonica/src/pix1.c 44
/src/leptonica/src/colormap.c 22
/src/leptonica/src/pix2.c 15
/src/leptonica/src/pix4.c 1
/src/leptonica/src/pix3.c 2
/src/leptonica/src/ptabasic.c 7
/src/leptonica/src/utils2.c 13
/src/leptonica/src/bilinear.c 11
/src/leptonica/src/affine.c 3
/src/leptonica/src/numabasic.c 7
/src/leptonica/src/numafunc1.c 1
/src/leptonica/src/pixconv.c 11
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/readfile.c 4
/src/leptonica/src/tiffio.c 7
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 7
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 3
/src/libtiff/libtiff/tif_close.c 2
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 2
/src/leptonica/src/bbuffer.c 3
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/jpegio.c 4
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 3
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 9
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 1
/src/libpng/pngread.c 12
/src/libpng/png.c 51
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 18
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 16
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 6
/src/leptonica/src/gifiostub.c 1
/src/leptonica/src/jp2kiostub.c 1
/src/leptonica/src/webpio.c 2
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/ptafunc1.c 1
/src/leptonica/src/pix5.c 1

Fuzzer: ccbord_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 757 58.3%
gold [1:9] 6 0.46%
yellow [10:29] 6 0.46%
greenyellow [30:49] 6 0.46%
lawngreen 50+ 523 40.2%
All colors 1298 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1728 1728 1 :

['pixRemoveColormap']

2540 3300 pixEqualWithAlpha call site: 00957 /src/leptonica/src/compare.c:267
812 822 2 :

['pixConvertLossless', 'lept_stderr']

812 1528 pixEqualWithAlpha call site: 00960 /src/leptonica/src/compare.c:278
72 72 1 :

['ptaCopy']

72 72 ptaaGetPta call site: 01132 /src/leptonica/src/ptabasic.c:1074
48 48 1 :

['pixAlphaIsOpaque']

10080 11053 pixEqualWithAlpha call site: 00660 /src/leptonica/src/compare.c:218
48 48 1 :

['pixSetAllArbitrary']

48 420 pixAddBorderGeneral call site: 00546 /src/leptonica/src/pix2.c:1905
36 110 2 :

['pixGetPixel', 'pixcmapGetColor']

36 110 pixEqualWithCmap call site: 00684 /src/leptonica/src/compare.c:416
29 36 2 :

['ccbaExtendArray', 'returnErrorInt']

29 36 ccbaAddCcb call site: 01055 /src/leptonica/src/ccbord.c:467
28 28 1 :

['stringNew']

28 28 stringReplace call site: 00197 /src/leptonica/src/utils2.c:352
24 141 10 :

['pixSetWpl', 'pixGetDimensions', 'pixdata_malloc', 'pixGetWpl', 'pixCopyResolution', 'returnErrorInt', 'pixSetDepth', 'pixSetWidth', 'pixFreeAndSetData', 'pixSetHeight']

24 141 pixResizeImageData call site: 00216 /src/leptonica/src/pix1.c:762
18 18 1 :

['numaaDestroy']

18 40 ccbDestroy call site: 00476 /src/leptonica/src/ccbord.c:433
0 388 2 :

['pixClone', 'pixCopy']

0 511 pixaAddPix call site: 00423 /src/leptonica/src/pixabasic.c:505
0 377 1 :

['pixCopy']

0 377 pixaGetPix call site: 00490 /src/leptonica/src/pixabasic.c:662

Runtime coverage analysis

Covered functions
166
Functions that are reachable but not covered
53
Reachable functions
218
Percentage of reachable functions covered
75.69%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/ccbord_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 4
/src/leptonica/src/spixio.c 2
/src/leptonica/src/pix1.c 41
/src/leptonica/src/colormap.c 17
/src/leptonica/src/pix2.c 10
/src/leptonica/src/pix4.c 2
/src/leptonica/src/pix3.c 6
/src/leptonica/src/ccbord.c 19
/src/leptonica/src/conncomp.c 9
/src/leptonica/src/boxbasic.c 15
/src/leptonica/src/utils2.c 4
/src/leptonica/src/stack.c 6
/src/leptonica/src/pixabasic.c 8
/src/leptonica/src/pix5.c 1
/src/leptonica/src/boxfunc1.c 1
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 7
/src/leptonica/src/ptabasic.c 16
/src/leptonica/src/numabasic.c 13
/src/leptonica/src/seedfill.c 3
/src/leptonica/src/compare.c 5
/src/leptonica/src/pixconv.c 12
/src/leptonica/src/ptafunc1.c 4

Fuzzer: boxfunc3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 9633 99.8%
gold [1:9] 0 0.0%
yellow [10:29] 12 0.12%
greenyellow [30:49] 1 0.01%
lawngreen 50+ 1 0.01%
All colors 9647 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
172 177 6 :

['boxaAddBox', 'boxaDestroy', '__isoc99_fscanf', 'boxaCreate', 'boxCreate', 'lept_stderr']

172 219 boxaReadStream call site: 00015 /src/leptonica/src/boxbasic.c:2028
0 7 1 :

['returnErrorPtr']

0 7 boxaReadMem call site: 00008 /src/leptonica/src/boxbasic.c:2071
0 7 1 :

['returnErrorPtr']

0 7 fopenReadFromMemory call site: 00010 /src/leptonica/src/utils2.c:1960
0 0 None 174 228 boxaReadStream call site: 00013 /src/leptonica/src/boxbasic.c:2025
0 0 None 2 157 boxaReadMem call site: 00004 /src/leptonica/src/boxbasic.c:2069
0 0 None 2 9 fopenReadFromMemory call site: 00008 /src/leptonica/src/utils2.c:1956
0 0 None 0 0 leptSetStderrHandler call site: 00002 /src/leptonica/src/utils1.c:353
0 0 None 0 0 lept_stderr call site: 00007 /src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions
9
Functions that are reachable but not covered
2143
Reachable functions
2154
Percentage of reachable functions covered
0.51%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/boxfunc3_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 12
/src/leptonica/src/boxbasic.c 32
/src/leptonica/src/utils2.c 31
/src/leptonica/src/readfile.c 5
/src/leptonica/src/tiffio.c 15
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 11
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 7
/src/libtiff/libtiff/tif_close.c 3
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 4
/src/leptonica/src/bbuffer.c 6
/src/leptonica/src/pix1.c 45
/src/leptonica/src/colormap.c 26
/src/leptonica/src/pix2.c 34
/src/leptonica/src/pix4.c 3
/src/leptonica/src/pix3.c 6
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/pixconv.c 18
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/jpegio.c 9
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 4
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 18
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 2
/src/libpng/pngread.c 12
/src/libpng/png.c 53
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 22
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 21
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 8
/src/leptonica/src/gifiostub.c 2
/src/leptonica/src/jp2kiostub.c 3
/src/leptonica/src/webpio.c 4
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 2
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/spixio.c 6
/src/leptonica/src/boxfunc2.c 6
/src/leptonica/src/numabasic.c 22
/src/leptonica/src/numafunc1.c 8
/src/leptonica/src/ptra.c 11
/src/leptonica/src/boxfunc4.c 1
/src/leptonica/src/boxfunc1.c 6
/src/leptonica/src/boxfunc3.c 7
/src/leptonica/src/graphics.c 8
/src/leptonica/src/ptabasic.c 9
/src/leptonica/src/ptafunc1.c 1
/src/leptonica/src/grayquant.c 3
/src/leptonica/src/ptafunc2.c 1
/src/leptonica/src/map.c 4
/src/leptonica/src/rbtree.c 20
/src/leptonica/src/scale1.c 27
/src/leptonica/src/scale2.c 17
/src/leptonica/src/enhance.c 6
/src/leptonica/src/fpix1.c 7
/src/leptonica/src/convolve.c 4
/src/leptonica/src/pixacc.c 8
/src/leptonica/src/pixarith.c 3
/src/leptonica/src/binexpand.c 5
/src/leptonica/src/pageseg.c 1
/src/leptonica/src/binreduce.c 3
/src/leptonica/src/morph.c 11
/src/leptonica/src/sel1.c 7
/src/leptonica/src/pixabasic.c 8
/src/leptonica/src/seedfill.c 2
/src/leptonica/src/compare.c 5
/src/leptonica/src/morphseq.c 2
/src/leptonica/src/sarray1.c 11
/src/leptonica/src/writefile.c 6
/src/leptonica/src/blend.c 2
/src/leptonica/src/pixafunc2.c 1
/src/leptonica/src/bytearray.c 10
/src/libjpeg-turbo/jcapimin.c 5
/src/libjpeg-turbo/jdatadst.c 1
/src/libjpeg-turbo/jcparam.c 11
/src/libjpeg-turbo/jcapistd.c 2
/src/libjpeg-turbo/jcinit.c 1
/src/libjpeg-turbo/jcmaster.c 4
/src/libjpeg-turbo/jccolor.c 3
/src/libjpeg-turbo/jcsample.c 3
/src/libjpeg-turbo/jcprepct.c 4
/src/libjpeg-turbo/jclossls.c 3
/src/libjpeg-turbo/jclhuff.c 1
/src/libjpeg-turbo/jcdiffct.c 3
/src/libjpeg-turbo/jcdctmgr.c 2
/src/libjpeg-turbo/jcarith.c 1
/src/libjpeg-turbo/jcphuff.c 1
/src/libjpeg-turbo/jchuff.c 1
/src/libjpeg-turbo/jccoefct.c 2
/src/libjpeg-turbo/jcmainct.c 3
/src/libjpeg-turbo/jcmarker.c 1
/src/libpng/pngwrite.c 14
/src/libpng/pngwio.c 3
/src/zlib/deflate.c 16
/src/libpng/pngwutil.c 50
/src/zlib/trees.c 20
/src/libpng/pngwtran.c 5
/src/leptonica/src/psio2.c 5
/src/libwebp/src/enc/picture_enc.c 14
/src/libwebp/src/enc/../../src/webp/encode.h 2
/src/libwebp/src/enc/config_enc.c 2
/src/libwebp/src/enc/webp_enc.c 12
/src/libwebp/src/enc/picture_csp_enc.c 21
/src/libwebp/sharpyuv/sharpyuv.c 20
/src/libwebp/sharpyuv/sharpyuv_dsp.c 1
/src/libwebp/sharpyuv/sharpyuv_sse2.c 1
/src/libwebp/sharpyuv/sharpyuv_gamma.c 32
/src/libwebp/sharpyuv/sharpyuv_csp.c 1
/src/libwebp/src/enc/../../src/dsp/yuv.h 4
/src/libwebp/src/enc/../../src/utils/random_utils.h 2
/src/libwebp/src/enc/picture_tools_enc.c 6
/src/libwebp/src/dsp/enc.c 4
/src/libwebp/src/dsp/enc_sse2.c 1
/src/libwebp/src/dsp/enc_sse41.c 1
/src/libwebp/src/enc/tree_enc.c 7
/src/libwebp/src/dsp/cost.c 2
/src/libwebp/src/dsp/cost_sse2.c 1
/src/libwebp/src/enc/alpha_enc.c 5
/src/libwebp/src/enc/token_enc.c 8
/src/libwebp/src/enc/analysis_enc.c 9
/src/libwebp/src/enc/iterator_enc.c 23
/src/libwebp/src/enc/frame_enc.c 30
/src/libwebp/src/utils/bit_writer_utils.c 15
/src/libwebp/src/enc/syntax_enc.c 15
/src/libwebp/src/enc/quant_enc.c 36
/src/libwebp/src/enc/filter_enc.c 7
/src/libwebp/src/enc/../../src/enc/cost_enc.h 3
/src/libwebp/src/enc/cost_enc.c 7
/src/libwebp/src/enc/../../src/dsp/quant.h 2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h 1
/src/libwebp/src/dsp/ssim.c 2
/src/libwebp/src/dsp/ssim_sse2.c 1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h 5
/src/libwebp/src/enc/../../src/utils/utils.h 3
/src/libwebp/src/enc/vp8l_enc.c 17
/src/libwebp/src/dsp/lossless_enc.c 4
/src/libwebp/src/dsp/lossless_enc_sse2.c 1
/src/libwebp/src/dsp/lossless_enc_sse41.c 1
/src/libwebp/src/enc/backward_references_enc.c 5
/src/libwebp/src/utils/palette.c 2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h 1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h 3
/src/libwebp/src/enc/histogram_enc.c 2
/src/libwebp/src/enc/picture_rescale_enc.c 4
/src/leptonica/src/pdfio1.c 5
/src/leptonica/src/colorcontent.c 1
/src/leptonica/src/dnafunc1.c 4
/src/leptonica/src/dnabasic.c 17
/src/leptonica/src/hashmap.c 4
/src/leptonica/src/pdfio2.c 28
/src/leptonica/src/encoding.c 2
/src/leptonica/src/jp2kheader.c 5
/src/leptonica/src/zlibmem.c 1
/src/leptonica/src/conncomp.c 10
/src/leptonica/src/stack.c 6
/src/leptonica/src/pix5.c 1

Fuzzer: morphapp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 9191 94.9%
gold [1:9] 5 0.05%
yellow [10:29] 7 0.07%
greenyellow [30:49] 5 0.05%
lawngreen 50+ 471 4.86%
All colors 9679 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
9570 9570 2 :

['fclose', 'pixReadStream']

9570 9577 pixRead call site: 00135 /src/leptonica/src/readfile.c:197
4804 5184 10 :

['selaGetSel', 'pixAnd', 'pixDilate', 'pixDestroy', 'pixHMT', 'pixClose', 'pixCreateTemplate', 'pixOpen', 'pixSetAll', 'pixErode']

4804 5191 pixIntersectionOfMorphOps call site: 05785 /src/leptonica/src/morphapp.c:558
3478 3478 2 :

['pixGetRGBComponent', 'pixCreateRGBImage']

3478 5174 pixBlockconv call site: 05681 /src/leptonica/src/convolve.c:167
1918 1918 1 :

['pixScaleAndTransferAlpha']

1918 1918 pixScaleBySamplingWithShift call site: 05625 /src/leptonica/src/scale1.c:1385
1728 1728 1 :

['pixRemoveColormap']

2540 3300 pixEqualWithAlpha call site: 09608 /src/leptonica/src/compare.c:267
1657 3741 10 :

['pixEqual', 'pixCopy', 'selCreateBrick', 'selSetElement', 'pixDilate', 'pixAnd', 'pixDestroy', 'selDestroy', 'pixCreateTemplate', 'lept_stderr']

1657 3748 pixSeedfillMorph call site: 09525 /src/leptonica/src/morphapp.c:1035
1145 1145 1 :

['pixShiftAndTransferAlpha']

1145 1145 pixRemoveBorderGeneral call site: 05931 /src/leptonica/src/pix2.c:2036
812 822 2 :

['pixConvertLossless', 'lept_stderr']

812 1528 pixEqualWithAlpha call site: 09611 /src/leptonica/src/compare.c:278
425 425 1 :

['pixScaleBinaryWithShift']

425 425 pixScaleBySamplingWithShift call site: 05607 /src/leptonica/src/scale1.c:1365
110 110 2 :

['pixGetPixel', 'pixcmapGetColor']

110 110 pixEqualWithCmap call site: 09557 /src/leptonica/src/compare.c:416
98 98 1 :

['rasteropVAlignedLow']

98 98 rasteropLow call site: 02161 /src/leptonica/src/roplow.c:569
48 48 1 :

['pixAlphaIsOpaque']

10080 11053 pixEqualWithAlpha call site: 09541 /src/leptonica/src/compare.c:218

Runtime coverage analysis

Covered functions
180
Functions that are reachable but not covered
1949
Reachable functions
2128
Percentage of reachable functions covered
8.41%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/morphapp_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 12
/src/leptonica/src/spixio.c 6
/src/leptonica/src/pix1.c 46
/src/leptonica/src/colormap.c 22
/src/leptonica/src/pix2.c 29
/src/leptonica/src/pix4.c 3
/src/leptonica/src/pix3.c 9
/src/leptonica/src/readfile.c 5
/src/leptonica/src/utils2.c 30
/src/leptonica/src/tiffio.c 15
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 11
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 7
/src/libtiff/libtiff/tif_close.c 3
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 4
/src/leptonica/src/bbuffer.c 6
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/pixconv.c 19
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/jpegio.c 9
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 4
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 18
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 2
/src/libpng/pngread.c 12
/src/libpng/png.c 53
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 22
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 21
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 8
/src/leptonica/src/gifiostub.c 2
/src/leptonica/src/jp2kiostub.c 3
/src/leptonica/src/webpio.c 4
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 2
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/morphapp.c 13
/src/leptonica/src/conncomp.c 10
/src/leptonica/src/boxbasic.c 19
/src/leptonica/src/stack.c 6
/src/leptonica/src/pixabasic.c 14
/src/leptonica/src/pix5.c 1
/src/leptonica/src/boxfunc1.c 1
/src/leptonica/src/ptabasic.c 7
/src/leptonica/src/paintcmap.c 1
/src/leptonica/src/scale2.c 25
/src/leptonica/src/scale1.c 29
/src/leptonica/src/enhance.c 6
/src/leptonica/src/fpix1.c 7
/src/leptonica/src/convolve.c 5
/src/leptonica/src/pixacc.c 8
/src/leptonica/src/pixarith.c 5
/src/leptonica/src/grayquant.c 7
/src/leptonica/src/seedfill.c 5
/src/leptonica/src/queue.c 6
/src/leptonica/src/sel1.c 13
/src/leptonica/src/morph.c 19
/src/leptonica/src/graymorph.c 2
/src/leptonica/src/morphseq.c 3
/src/leptonica/src/sarray1.c 11
/src/leptonica/src/binreduce.c 3
/src/leptonica/src/binexpand.c 5
/src/leptonica/src/writefile.c 6
/src/leptonica/src/blend.c 2
/src/leptonica/src/pixafunc2.c 1
/src/leptonica/src/numabasic.c 19
/src/leptonica/src/bytearray.c 10
/src/libjpeg-turbo/jcapimin.c 5
/src/libjpeg-turbo/jdatadst.c 1
/src/libjpeg-turbo/jcparam.c 11
/src/libjpeg-turbo/jcapistd.c 2
/src/libjpeg-turbo/jcinit.c 1
/src/libjpeg-turbo/jcmaster.c 4
/src/libjpeg-turbo/jccolor.c 3
/src/libjpeg-turbo/jcsample.c 3
/src/libjpeg-turbo/jcprepct.c 4
/src/libjpeg-turbo/jclossls.c 3
/src/libjpeg-turbo/jclhuff.c 1
/src/libjpeg-turbo/jcdiffct.c 3
/src/libjpeg-turbo/jcdctmgr.c 2
/src/libjpeg-turbo/jcarith.c 1
/src/libjpeg-turbo/jcphuff.c 1
/src/libjpeg-turbo/jchuff.c 1
/src/libjpeg-turbo/jccoefct.c 2
/src/libjpeg-turbo/jcmainct.c 3
/src/libjpeg-turbo/jcmarker.c 1
/src/libpng/pngwrite.c 14
/src/libpng/pngwio.c 3
/src/zlib/deflate.c 16
/src/libpng/pngwutil.c 50
/src/zlib/trees.c 20
/src/libpng/pngwtran.c 5
/src/leptonica/src/psio2.c 5
/src/libwebp/src/enc/picture_enc.c 14
/src/libwebp/src/enc/../../src/webp/encode.h 2
/src/libwebp/src/enc/config_enc.c 2
/src/libwebp/src/enc/webp_enc.c 12
/src/libwebp/src/enc/picture_csp_enc.c 21
/src/libwebp/sharpyuv/sharpyuv.c 20
/src/libwebp/sharpyuv/sharpyuv_dsp.c 1
/src/libwebp/sharpyuv/sharpyuv_sse2.c 1
/src/libwebp/sharpyuv/sharpyuv_gamma.c 32
/src/libwebp/sharpyuv/sharpyuv_csp.c 1
/src/libwebp/src/enc/../../src/dsp/yuv.h 4
/src/libwebp/src/enc/../../src/utils/random_utils.h 2
/src/libwebp/src/enc/picture_tools_enc.c 6
/src/libwebp/src/dsp/enc.c 4
/src/libwebp/src/dsp/enc_sse2.c 1
/src/libwebp/src/dsp/enc_sse41.c 1
/src/libwebp/src/enc/tree_enc.c 7
/src/libwebp/src/dsp/cost.c 2
/src/libwebp/src/dsp/cost_sse2.c 1
/src/libwebp/src/enc/alpha_enc.c 5
/src/libwebp/src/enc/token_enc.c 8
/src/libwebp/src/enc/analysis_enc.c 9
/src/libwebp/src/enc/iterator_enc.c 23
/src/libwebp/src/enc/frame_enc.c 30
/src/libwebp/src/utils/bit_writer_utils.c 15
/src/libwebp/src/enc/syntax_enc.c 15
/src/libwebp/src/enc/quant_enc.c 36
/src/libwebp/src/enc/filter_enc.c 7
/src/libwebp/src/enc/../../src/enc/cost_enc.h 3
/src/libwebp/src/enc/cost_enc.c 7
/src/libwebp/src/enc/../../src/dsp/quant.h 2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h 1
/src/libwebp/src/dsp/ssim.c 2
/src/libwebp/src/dsp/ssim_sse2.c 1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h 5
/src/libwebp/src/enc/../../src/utils/utils.h 3
/src/libwebp/src/enc/vp8l_enc.c 17
/src/libwebp/src/dsp/lossless_enc.c 4
/src/libwebp/src/dsp/lossless_enc_sse2.c 1
/src/libwebp/src/dsp/lossless_enc_sse41.c 1
/src/libwebp/src/enc/backward_references_enc.c 5
/src/libwebp/src/utils/palette.c 2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h 1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h 3
/src/libwebp/src/enc/histogram_enc.c 2
/src/libwebp/src/enc/picture_rescale_enc.c 4
/src/leptonica/src/pdfio1.c 5
/src/leptonica/src/colorcontent.c 1
/src/leptonica/src/dnafunc1.c 4
/src/leptonica/src/dnabasic.c 17
/src/leptonica/src/hashmap.c 4
/src/leptonica/src/pdfio2.c 28
/src/leptonica/src/encoding.c 2
/src/leptonica/src/jp2kheader.c 5
/src/leptonica/src/zlibmem.c 1
/src/leptonica/src/ptra.c 9
/src/leptonica/src/numafunc1.c 2
/src/leptonica/src/compare.c 5

Fuzzer: morph_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 4837 95.2%
gold [1:9] 2 0.03%
yellow [10:29] 7 0.13%
greenyellow [30:49] 3 0.05%
lawngreen 50+ 227 4.47%
All colors 5076 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
9570 9570 2 :

['fclose', 'pixReadStream']

9570 9577 pixRead call site: 00135 /src/leptonica/src/readfile.c:197
1145 1145 1 :

['pixShiftAndTransferAlpha']

1145 1145 pixRemoveBorderGeneral call site: 04679 /src/leptonica/src/pix2.c:2036
238 238 2 :

['rasteropGeneralLow', 'rasteropVAlignedLow']

238 238 rasteropLow call site: 02160 /src/leptonica/src/roplow.c:566
48 48 1 :

['pixSetAllArbitrary']

48 420 pixAddBorderGeneral call site: 04651 /src/leptonica/src/pix2.c:1905
31 141 10 :

['pixSetWpl', 'pixGetDimensions', 'pixdata_malloc', 'pixGetWpl', 'pixCopyResolution', 'returnErrorInt', 'pixSetDepth', 'pixSetWidth', 'pixFreeAndSetData', 'pixSetHeight']

31 141 pixResizeImageData call site: 02072 /src/leptonica/src/pix1.c:762
31 31 2 :

['strlen', 'stringCat']

31 31 genPathname call site: 00160 /src/leptonica/src/utils2.c:3163
11 11 1 :

['pixClone']

11 11 pixAddBorder call site: 04913 /src/leptonica/src/pix2.c:1791
11 11 1 :

['pixClone']

11 11 pixRemoveBorder call site: 05066 /src/leptonica/src/pix2.c:1994
7 7 1 :

['returnErrorInt']

7 7 pixcmapAddRGBA call site: 00089 /src/leptonica/src/colormap.c:450
7 7 1 :

['returnErrorInt']

7 7 getMorphBorderPixelColor call site: 04910 /src/leptonica/src/morph.c:1766
7 7 1 :

['returnErrorInt']

7 7 pixCopyColormap call site: 02046 /src/leptonica/src/pix1.c:819
7 7 1 :

['returnErrorInt']

7 7 pixSetWidth call site: 00029 /src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions
100
Functions that are reachable but not covered
1140
Reachable functions
1241
Percentage of reachable functions covered
8.14%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/morph_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 7
/src/leptonica/src/spixio.c 3
/src/leptonica/src/pix1.c 44
/src/leptonica/src/colormap.c 17
/src/leptonica/src/pix2.c 20
/src/leptonica/src/pix4.c 1
/src/leptonica/src/pix3.c 4
/src/leptonica/src/readfile.c 4
/src/leptonica/src/utils2.c 13
/src/leptonica/src/tiffio.c 7
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 7
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 3
/src/libtiff/libtiff/tif_close.c 2
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 2
/src/leptonica/src/bbuffer.c 3
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/pixconv.c 11
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/jpegio.c 4
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 3
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 9
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 1
/src/libpng/pngread.c 12
/src/libpng/png.c 51
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 18
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 16
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 6
/src/leptonica/src/gifiostub.c 1
/src/leptonica/src/jp2kiostub.c 1
/src/leptonica/src/webpio.c 2
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/boxbasic.c 5
/src/leptonica/src/pix5.c 1
/src/leptonica/src/boxfunc1.c 1
/src/leptonica/src/sel1.c 9
/src/leptonica/src/morph.c 10
/src/leptonica/src/fmorphgen.1.c 2
/src/leptonica/src/fmorphgenlow.1.c 117

Fuzzer: adaptmap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 9057 93.1%
gold [1:9] 3 0.03%
yellow [10:29] 9 0.09%
greenyellow [30:49] 10 0.10%
lawngreen 50+ 646 6.64%
All colors 9725 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
11721 11721 2 :

['pixaConvertToPdf', 'pixaDestroy']

11721 11735 pixMorphSequence call site: 08471 /src/leptonica/src/morphseq.c:243
9570 9570 2 :

['fclose', 'pixReadStream']

9570 9577 pixRead call site: 00135 /src/leptonica/src/readfile.c:197
4638 6640 3 :

['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']

4638 6730 pixGetBackgroundRGBMap call site: 09342 /src/leptonica/src/adaptmap.c:1207
4638 4678 2 :

['pixDestroy', 'pixSmoothConnectedRegions']

4638 4768 pixGetBackgroundRGBMapMorph call site: 09250 /src/leptonica/src/adaptmap.c:1426
3694 3694 3 :

['pixAnd', 'pixConvertTo8', 'pixScale']

5240 5937 pixGetBackgroundGrayMapMorph call site: 09156 /src/leptonica/src/adaptmap.c:1283
3478 3478 2 :

['pixGetRGBComponent', 'pixCreateRGBImage']

3478 5174 pixBlockconv call site: 09069 /src/leptonica/src/convolve.c:167
2960 2960 2 :

['pixConvertTo8', 'pixScale']

9800 18680 pixGetBackgroundRGBMapMorph call site: 09215 /src/leptonica/src/adaptmap.c:1367
1918 1918 1 :

['pixScaleAndTransferAlpha']

1918 1918 pixScaleBySamplingWithShift call site: 08793 /src/leptonica/src/scale1.c:1385
1546 3548 3 :

['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']

1546 3578 pixGetBackgroundGrayMap call site: 08753 /src/leptonica/src/adaptmap.c:1018
1546 1546 1 :

['pixSmoothConnectedRegions']

1546 1616 pixGetBackgroundGrayMapMorph call site: 09175 /src/leptonica/src/adaptmap.c:1304
1145 1145 1 :

['pixShiftAndTransferAlpha']

1145 1145 pixRemoveBorderGeneral call site: 04841 /src/leptonica/src/pix2.c:2036
734 1518 3 :

['pixRasterop', 'pixAnd', 'pixDestroy']

734 1518 pixCombineMasked call site: 09615 /src/leptonica/src/pix3.c:411

Runtime coverage analysis

Covered functions
165
Functions that are reachable but not covered
1947
Reachable functions
2113
Percentage of reachable functions covered
7.86%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/adaptmap_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 12
/src/leptonica/src/spixio.c 6
/src/leptonica/src/pix1.c 46
/src/leptonica/src/colormap.c 24
/src/leptonica/src/pix2.c 29
/src/leptonica/src/pix4.c 7
/src/leptonica/src/pix3.c 9
/src/leptonica/src/readfile.c 5
/src/leptonica/src/utils2.c 30
/src/leptonica/src/tiffio.c 15
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 11
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 7
/src/libtiff/libtiff/tif_close.c 3
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 4
/src/leptonica/src/bbuffer.c 6
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/pixconv.c 22
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/jpegio.c 9
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 4
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 18
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 2
/src/libpng/pngread.c 12
/src/libpng/png.c 53
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 22
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 21
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 8
/src/leptonica/src/gifiostub.c 2
/src/leptonica/src/jp2kiostub.c 3
/src/leptonica/src/webpio.c 4
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 2
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/adaptmap.c 24
/src/leptonica/src/grayquant.c 4
/src/leptonica/src/morphseq.c 2
/src/leptonica/src/sarray1.c 11
/src/leptonica/src/pixabasic.c 8
/src/leptonica/src/boxbasic.c 18
/src/leptonica/src/morph.c 11
/src/leptonica/src/sel1.c 7
/src/leptonica/src/binreduce.c 3
/src/leptonica/src/scale2.c 19
/src/leptonica/src/binexpand.c 5
/src/leptonica/src/scale1.c 30
/src/leptonica/src/enhance.c 9
/src/leptonica/src/fpix1.c 7
/src/leptonica/src/convolve.c 5
/src/leptonica/src/pixacc.c 8
/src/leptonica/src/pixarith.c 4
/src/leptonica/src/writefile.c 6
/src/leptonica/src/blend.c 2
/src/leptonica/src/pixafunc2.c 1
/src/leptonica/src/numabasic.c 21
/src/leptonica/src/bytearray.c 10
/src/libjpeg-turbo/jcapimin.c 5
/src/libjpeg-turbo/jdatadst.c 1
/src/libjpeg-turbo/jcparam.c 11
/src/libjpeg-turbo/jcapistd.c 2
/src/libjpeg-turbo/jcinit.c 1
/src/libjpeg-turbo/jcmaster.c 4
/src/libjpeg-turbo/jccolor.c 3
/src/libjpeg-turbo/jcsample.c 3
/src/libjpeg-turbo/jcprepct.c 4
/src/libjpeg-turbo/jclossls.c 3
/src/libjpeg-turbo/jclhuff.c 1
/src/libjpeg-turbo/jcdiffct.c 3
/src/libjpeg-turbo/jcdctmgr.c 2
/src/libjpeg-turbo/jcarith.c 1
/src/libjpeg-turbo/jcphuff.c 1
/src/libjpeg-turbo/jchuff.c 1
/src/libjpeg-turbo/jccoefct.c 2
/src/libjpeg-turbo/jcmainct.c 3
/src/libjpeg-turbo/jcmarker.c 1
/src/libpng/pngwrite.c 14
/src/libpng/pngwio.c 3
/src/zlib/deflate.c 16
/src/libpng/pngwutil.c 50
/src/zlib/trees.c 20
/src/libpng/pngwtran.c 5
/src/leptonica/src/psio2.c 5
/src/libwebp/src/enc/picture_enc.c 14
/src/libwebp/src/enc/../../src/webp/encode.h 2
/src/libwebp/src/enc/config_enc.c 2
/src/libwebp/src/enc/webp_enc.c 12
/src/libwebp/src/enc/picture_csp_enc.c 21
/src/libwebp/sharpyuv/sharpyuv.c 20
/src/libwebp/sharpyuv/sharpyuv_dsp.c 1
/src/libwebp/sharpyuv/sharpyuv_sse2.c 1
/src/libwebp/sharpyuv/sharpyuv_gamma.c 32
/src/libwebp/sharpyuv/sharpyuv_csp.c 1
/src/libwebp/src/enc/../../src/dsp/yuv.h 4
/src/libwebp/src/enc/../../src/utils/random_utils.h 2
/src/libwebp/src/enc/picture_tools_enc.c 6
/src/libwebp/src/dsp/enc.c 4
/src/libwebp/src/dsp/enc_sse2.c 1
/src/libwebp/src/dsp/enc_sse41.c 1
/src/libwebp/src/enc/tree_enc.c 7
/src/libwebp/src/dsp/cost.c 2
/src/libwebp/src/dsp/cost_sse2.c 1
/src/libwebp/src/enc/alpha_enc.c 5
/src/libwebp/src/enc/token_enc.c 8
/src/libwebp/src/enc/analysis_enc.c 9
/src/libwebp/src/enc/iterator_enc.c 23
/src/libwebp/src/enc/frame_enc.c 30
/src/libwebp/src/utils/bit_writer_utils.c 15
/src/libwebp/src/enc/syntax_enc.c 15
/src/libwebp/src/enc/quant_enc.c 36
/src/libwebp/src/enc/filter_enc.c 7
/src/libwebp/src/enc/../../src/enc/cost_enc.h 3
/src/libwebp/src/enc/cost_enc.c 7
/src/libwebp/src/enc/../../src/dsp/quant.h 2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h 1
/src/libwebp/src/dsp/ssim.c 2
/src/libwebp/src/dsp/ssim_sse2.c 1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h 5
/src/libwebp/src/enc/../../src/utils/utils.h 3
/src/libwebp/src/enc/vp8l_enc.c 17
/src/libwebp/src/dsp/lossless_enc.c 4
/src/libwebp/src/dsp/lossless_enc_sse2.c 1
/src/libwebp/src/dsp/lossless_enc_sse41.c 1
/src/libwebp/src/enc/backward_references_enc.c 5
/src/libwebp/src/utils/palette.c 2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h 1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h 3
/src/libwebp/src/enc/histogram_enc.c 2
/src/libwebp/src/enc/picture_rescale_enc.c 4
/src/leptonica/src/pdfio1.c 5
/src/leptonica/src/colorcontent.c 1
/src/leptonica/src/dnafunc1.c 4
/src/leptonica/src/dnabasic.c 17
/src/leptonica/src/hashmap.c 4
/src/leptonica/src/pdfio2.c 28
/src/leptonica/src/encoding.c 2
/src/leptonica/src/jp2kheader.c 5
/src/leptonica/src/zlibmem.c 1
/src/leptonica/src/ptra.c 9
/src/leptonica/src/ptabasic.c 6
/src/leptonica/src/numafunc1.c 3
/src/leptonica/src/conncomp.c 10
/src/leptonica/src/stack.c 6
/src/leptonica/src/pix5.c 1
/src/leptonica/src/boxfunc1.c 1
/src/leptonica/src/paintcmap.c 1
/src/leptonica/src/graymorph.c 3
/src/leptonica/src/numafunc2.c 1
/src/leptonica/src/edge.c 2
/src/leptonica/src/seedfill.c 2

Fuzzer: compare_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 8387 94.7%
gold [1:9] 3 0.03%
yellow [10:29] 10 0.11%
greenyellow [30:49] 2 0.02%
lawngreen 50+ 446 5.04%
All colors 8848 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
3938 3938 1 :

['pixScaleByIntSampling']

3938 85386 pixGetPerceptualDiff call site: 00463 /src/leptonica/src/compare.c:1741
3348 3348 2 :

['pixGetAverageMasked', 'pixAbsDifference']

3348 3828 pixCompareRGB call site: 08690 /src/leptonica/src/compare.c:1175
1145 1145 1 :

['pixShiftAndTransferAlpha']

1145 1145 pixRemoveBorderGeneral call site: 01136 /src/leptonica/src/pix2.c:2036
1116 1116 2 :

['pixGetAverageMasked', 'pixAbsDifference']

1116 1196 pixCompareGray call site: 08509 /src/leptonica/src/compare.c:1040
1073 1073 1 :

['pixGetRGBComponentCmap']

1073 1073 pixGetRGBComponent call site: 00544 /src/leptonica/src/pix2.c:2486
812 822 2 :

['pixConvertLossless', 'lept_stderr']

812 1528 pixEqualWithAlpha call site: 08787 /src/leptonica/src/compare.c:278
305 305 1 :

['pixConvert1To8Cmap']

305 305 pixConvertTo8 call site: 00226 /src/leptonica/src/pixconv.c:3071
209 350 4 :

['pixcmapConvertTo8', 'pixcmapAddColor', 'pixSetColormap', 'pixcmapCreate']

209 350 pixConvert2To8 call site: 00359 /src/leptonica/src/pixconv.c:2468
170 311 4 :

['pixcmapConvertTo8', 'pixcmapAddColor', 'pixSetColormap', 'pixcmapCreate']

170 311 pixConvert4To8 call site: 00391 /src/leptonica/src/pixconv.c:2571
161 538 2 :

['pixAddGrayColormap8', 'pixCopy']

161 538 pixConvertTo8 call site: 00397 /src/leptonica/src/pixconv.c:3083
161 161 1 :

['pixAddGrayColormap8']

161 201 pixConvertTo8 call site: 00435 /src/leptonica/src/pixconv.c:3098
161 161 1 :

['pixAddGrayColormap8']

161 161 pixConvertTo8 call site: 00409 /src/leptonica/src/pixconv.c:3092

Runtime coverage analysis

Covered functions
115
Functions that are reachable but not covered
1889
Reachable functions
2005
Percentage of reachable functions covered
5.79%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/compare_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 12
/src/leptonica/src/spixio.c 6
/src/leptonica/src/pix1.c 45
/src/leptonica/src/colormap.c 21
/src/leptonica/src/pix2.c 27
/src/leptonica/src/pix4.c 4
/src/leptonica/src/pix3.c 6
/src/leptonica/src/utils2.c 28
/src/leptonica/src/pixconv.c 19
/src/leptonica/src/rop.c 1
/src/leptonica/src/roplow.c 9
/src/leptonica/src/compare.c 8
/src/leptonica/src/scale1.c 30
/src/leptonica/src/scale2.c 22
/src/leptonica/src/enhance.c 6
/src/leptonica/src/fpix1.c 7
/src/leptonica/src/convolve.c 4
/src/leptonica/src/pixacc.c 8
/src/leptonica/src/pixarith.c 6
/src/leptonica/src/graymorph.c 6
/src/leptonica/src/sarray1.c 11
/src/leptonica/src/bytearray.c 7
/src/leptonica/src/numabasic.c 11
/src/leptonica/src/numafunc1.c 2
/src/leptonica/src/gplot.c 6
/src/leptonica/src/writefile.c 7
/src/leptonica/src/readfile.c 5
/src/leptonica/src/tiffio.c 15
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 11
/src/libtiff/libtiff/tif_unix.c 11
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 12
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 112
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 7
/src/libtiff/libtiff/tif_close.c 3
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/bmpio.c 4
/src/leptonica/src/bbuffer.c 6
/src/leptonica/src/rotateorth.c 6
/src/leptonica/src/jpegio.c 9
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jdapimin.c 6
/src/libjpeg-turbo/jcomapi.c 4
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdmarker.c 3
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 6
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jdapistd.c 3
/src/libjpeg-turbo/jquant1.c 8
/src/libjpeg-turbo/jquant2.c 3
/src/libjpeg-turbo/jdmerge.c 3
/src/libjpeg-turbo/simd/x86_64/jsimd.c 18
/src/libjpeg-turbo/jdcolor.c 5
/src/libjpeg-turbo/jdsample.c 3
/src/libjpeg-turbo/jdpostct.c 3
/src/libjpeg-turbo/jdlossls.c 3
/src/libjpeg-turbo/jdlhuff.c 1
/src/libjpeg-turbo/jddiffct.c 3
/src/libjpeg-turbo/jddctmgr.c 2
/src/libjpeg-turbo/jdarith.c 1
/src/libjpeg-turbo/jdphuff.c 1
/src/libjpeg-turbo/jdhuff.c 1
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jdcoefct.c 2
/src/libjpeg-turbo/jdmainct.c 4
/src/leptonica/src/pngio.c 2
/src/libpng/pngread.c 12
/src/libpng/png.c 53
/src/libpng/pngmem.c 11
/src/libpng/pngerror.c 22
/src/libpng/pngrio.c 2
/src/zlib/inflate.c 9
/src/libpng/pngrutil.c 46
/src/zlib/crc32.c 5
/src/libpng/pngset.c 21
/src/zlib/adler32.c 2
/src/zlib/inftrees.c 1
/src/zlib/inffast.c 1
/src/libpng/pngrtran.c 30
/src/libpng/pngtrans.c 15
/src/libpng/pngget.c 13
/src/libtiff/libtiff/tif_read.c 11
/src/libtiff/libtiff/tif_getimage.c 4
/src/leptonica/src/pnmio.c 8
/src/leptonica/src/gifiostub.c 2
/src/leptonica/src/jp2kiostub.c 3
/src/leptonica/src/webpio.c 4
/work/include/webp/decode.h 1
/src/libwebp/src/dec/webp_dec.c 15
/src/libwebp/src/dec/../../src/utils/utils.h 5
/src/libwebp/src/dec/vp8l_dec.c 46
/src/libwebp/src/dec/vp8_dec.c 21
/src/libwebp/src/utils/bit_reader_utils.c 10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h 2
/src/libwebp/src/dec/../../src/webp/decode.h 3
/src/libwebp/src/dec/buffer_dec.c 7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h 1
/src/libwebp/src/dec/io_dec.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 3
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/dec/tree_dec.c 4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/dec/quant_dec.c 2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h 2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h 1
/src/libwebp/src/utils/rescaler_utils.c 2
/src/libwebp/src/dec/frame_dec.c 20
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dec/../../src/utils/random_utils.h 1
/src/libwebp/src/dec/alpha_dec.c 7
/src/libwebp/src/dsp/filters.c 2
/src/libwebp/src/dsp/filters_sse2.c 1
/src/libwebp/src/dsp/lossless.c 3
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h 1
/src/libwebp/src/utils/color_cache_utils.c 3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h 4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h 3
/src/libwebp/src/utils/huffman_utils.c 9
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 2
/src/libwebp/src/utils/quant_levels_dec_utils.c 9
/src/libwebp/src/dsp/rescaler.c 2
/src/libwebp/src/dsp/rescaler_sse2.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/leptonica/src/pixabasic.c 8
/src/leptonica/src/boxbasic.c 14
/src/leptonica/src/blend.c 2
/src/leptonica/src/pixafunc2.c 1
/src/leptonica/src/grayquant.c 3
/src/libjpeg-turbo/jcapimin.c 5
/src/libjpeg-turbo/jdatadst.c 1
/src/libjpeg-turbo/jcparam.c 11
/src/libjpeg-turbo/jcapistd.c 2
/src/libjpeg-turbo/jcinit.c 1
/src/libjpeg-turbo/jcmaster.c 4
/src/libjpeg-turbo/jccolor.c 3
/src/libjpeg-turbo/jcsample.c 3
/src/libjpeg-turbo/jcprepct.c 4
/src/libjpeg-turbo/jclossls.c 3
/src/libjpeg-turbo/jclhuff.c 1
/src/libjpeg-turbo/jcdiffct.c 3
/src/libjpeg-turbo/jcdctmgr.c 2
/src/libjpeg-turbo/jcarith.c 1
/src/libjpeg-turbo/jcphuff.c 1
/src/libjpeg-turbo/jchuff.c 1
/src/libjpeg-turbo/jccoefct.c 2
/src/libjpeg-turbo/jcmainct.c 3
/src/libjpeg-turbo/jcmarker.c 1
/src/libpng/pngwrite.c 14
/src/libpng/pngwio.c 3
/src/zlib/deflate.c 16
/src/libpng/pngwutil.c 50
/src/zlib/trees.c 20
/src/libpng/pngwtran.c 5
/src/leptonica/src/psio2.c 5
/src/libwebp/src/enc/picture_enc.c 14
/src/libwebp/src/enc/../../src/webp/encode.h 2
/src/libwebp/src/enc/config_enc.c 2
/src/libwebp/src/enc/webp_enc.c 12
/src/libwebp/src/enc/picture_csp_enc.c 21
/src/libwebp/sharpyuv/sharpyuv.c 20
/src/libwebp/sharpyuv/sharpyuv_dsp.c 1
/src/libwebp/sharpyuv/sharpyuv_sse2.c 1
/src/libwebp/sharpyuv/sharpyuv_gamma.c 32
/src/libwebp/sharpyuv/sharpyuv_csp.c 1
/src/libwebp/src/enc/../../src/dsp/yuv.h 4
/src/libwebp/src/enc/../../src/utils/random_utils.h 2
/src/libwebp/src/enc/picture_tools_enc.c 6
/src/libwebp/src/dsp/enc.c 4
/src/libwebp/src/dsp/enc_sse2.c 1
/src/libwebp/src/dsp/enc_sse41.c 1
/src/libwebp/src/enc/tree_enc.c 7
/src/libwebp/src/dsp/cost.c 2
/src/libwebp/src/dsp/cost_sse2.c 1
/src/libwebp/src/enc/alpha_enc.c 5
/src/libwebp/src/enc/token_enc.c 8
/src/libwebp/src/enc/analysis_enc.c 9
/src/libwebp/src/enc/iterator_enc.c 23
/src/libwebp/src/enc/frame_enc.c 30
/src/libwebp/src/utils/bit_writer_utils.c 15
/src/libwebp/src/enc/syntax_enc.c 15
/src/libwebp/src/enc/quant_enc.c 36
/src/libwebp/src/enc/filter_enc.c 7
/src/libwebp/src/enc/../../src/enc/cost_enc.h 3
/src/libwebp/src/enc/cost_enc.c 7
/src/libwebp/src/enc/../../src/dsp/quant.h 2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h 1
/src/libwebp/src/dsp/ssim.c 2
/src/libwebp/src/dsp/ssim_sse2.c 1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h 5
/src/libwebp/src/enc/../../src/utils/utils.h 3
/src/libwebp/src/enc/vp8l_enc.c 17
/src/libwebp/src/dsp/lossless_enc.c 4
/src/libwebp/src/dsp/lossless_enc_sse2.c 1
/src/libwebp/src/dsp/lossless_enc_sse41.c 1
/src/libwebp/src/enc/backward_references_enc.c 5
/src/libwebp/src/utils/palette.c 2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h 1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h 3
/src/libwebp/src/enc/histogram_enc.c 2
/src/libwebp/src/enc/picture_rescale_enc.c 4
/src/leptonica/src/pdfio1.c 3
/src/leptonica/src/colorcontent.c 1
/src/leptonica/src/dnafunc1.c 3
/src/leptonica/src/dnabasic.c 8
/src/leptonica/src/hashmap.c 4
/src/leptonica/src/pdfio2.c 24
/src/leptonica/src/encoding.c 2
/src/leptonica/src/jp2kheader.c 5
/src/leptonica/src/zlibmem.c 1
/src/leptonica/src/ptra.c 8
/src/leptonica/src/ptabasic.c 6
/src/leptonica/src/colormorph.c 1

Fuzzer: pageseg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 6596 71.7%
gold [1:9] 13 0.14%
yellow [10:29] 28 0.30%
greenyellow [30:49] 34 0.36%
lawngreen 50+ 2519 27.4%
All colors 9190 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
13600 13600 2 :

['pixGetBackgroundRGBMap', 'pixApplyInvBackgroundRGBMap']

13600 18526 pixBackgroundNorm call site: 00514 /src/leptonica/src/adaptmap.c:375
11895 12082 12 :

['pixScaleGrayLI', 'pixScaleAreaMap', 'pixConvertTo8Or32', 'pixGetDepth', 'pixUnsharpMasking', 'pixClone', 'pixDestroy', 'pixCopyInputFormat', 'pixCopyText', 'pixScaleSmooth', 'returnErrorPtr', 'pixScaleColorLI']

11895 12082 pixScaleGeneral call site: 01045 /src/leptonica/src/scale1.c:439
11330 11330 3 :

['pixRenderBoxArb', 'pixConvert1To4Cmap', 'pixacompAddPix']

11330 11581 pixFindPageForeground call site: 08685 /src/leptonica/src/pageseg.c:1085
3508 3548 3 :

['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']

3508 3578 pixGetBackgroundGrayMap call site: 06836 /src/leptonica/src/adaptmap.c:1018
3478 3478 2 :

['pixGetRGBComponent', 'pixCreateRGBImage']

3478 5174 pixBlockconv call site: 07149 /src/leptonica/src/convolve.c:167
2398 2398 1 :

['pixGenerateJpegData']

2398 2405 pixGenerateCIData call site: 05915 /src/leptonica/src/pdfio2.c:1270
1918 2341 11 :

['pixGetWpl', 'pixCopyResolution', 'pixGetData', 'pixCopyInputFormat', 'pixScaleResolution', 'returnErrorPtr', 'pixScaleAndTransferAlpha', 'lept_stderr', 'pixCreate', 'pixGetSpp', 'pixCopyColormap']

1918 2341 pixExpandReplicate call site: 00986 /src/leptonica/src/scale2.c:872
1513 1513 2 :

['pixRotateAMColor', 'pixRotateAMGray']

1513 1633 pixRotate call site: 07648 /src/leptonica/src/rotate.c:175
1504 1504 1 :

['pixRotate3Shear']

1504 1504 pixRotateShear call site: 07650 /src/leptonica/src/rotateshear.c:227
1187 1187 1 :

['pixAlphaBlendUniform']

1189 2050 pixGenerateFlateData call site: 06239 /src/leptonica/src/pdfio2.c:1378
1149 2729 4 :

['pixRotate2Shear', 'pixDestroy', 'pixGetRGBComponent', 'pixSetRGBComponent']

1149 2729 pixRotate2Shear call site: 07689 /src/leptonica/src/rotateshear.c:291
1145 1145 1 :

['pixShiftAndTransferAlpha']

1145 1145 pixRemoveBorderGeneral call site: 00869 /src/leptonica/src/pix2.c:2036

Runtime coverage analysis

Covered functions
689
Functions that are reachable but not covered
1155
Reachable functions
1815
Percentage of reachable functions covered
36.36%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/leptonica/prog/fuzzing/pageseg_fuzzer.cc 1
/src/leptonica/prog/fuzzing/leptfuzz.h 2
/src/leptonica/src/utils1.c 12
/src/leptonica/src/spixio.c 5
/src/leptonica/src/pix1.c 45
/src/leptonica/src/colormap.c 30
/src/leptonica/src/pix2.c 31
/src/leptonica/src/pix4.c 4
/src/leptonica/src/pix3.c 11
/src/leptonica/src/pixabasic.c 15
/src/leptonica/src/boxbasic.c 33
/src/leptonica/src/pageseg.c 9
/src/leptonica/src/pix5.c 3
/src/leptonica/src/boxfunc1.c 8
/src/leptonica/src/utils2.c 31
/src/leptonica/src/rop.c 3
/src/leptonica/src/roplow.c 10
/src/leptonica/src/pixconv.c 24
/src/leptonica/src/adaptmap.c 10
/src/leptonica/src/grayquant.c 3
/src/leptonica/src/morphseq.c 3
/src/leptonica/src/sarray1.c 11
/src/leptonica/src/morph.c 18
/src/leptonica/src/sel1.c 9
/src/leptonica/src/binreduce.c 3
/src/leptonica/src/scale2.c 17
/src/leptonica/src/binexpand.c 5
/src/leptonica/src/scale1.c 29
/src/leptonica/src/enhance.c 9
/src/leptonica/src/fpix1.c 7
/src/leptonica/src/convolve.c 5
/src/leptonica/src/pixacc.c 8
/src/leptonica/src/pixarith.c 3
/src/leptonica/src/writefile.c 7
/src/leptonica/src/blend.c 2
/src/leptonica/src/pixafunc2.c 3
/src/leptonica/src/numabasic.c 24
/src/leptonica/src/bytearray.c 10
/src/leptonica/src/bmpio.c 2
/src/leptonica/src/jpegio.c 6
/src/libjpeg-turbo/jerror.c 1
/src/libjpeg-turbo/jcapimin.c 5
/src/libjpeg-turbo/jmemmgr.c 1
/src/libjpeg-turbo/jmemnobs.c 3
/src/libjpeg-turbo/jdatadst.c 1
/src/libjpeg-turbo/jcparam.c 11
/src/libjpeg-turbo/jcomapi.c 4
/src/libjpeg-turbo/jstdhuff.c 2
/src/libjpeg-turbo/jcapistd.c 2
/src/libjpeg-turbo/jcinit.c 1
/src/libjpeg-turbo/jcmaster.c 4
/src/libjpeg-turbo/jutils.c 2
/src/libjpeg-turbo/jccolor.c 3
/src/libjpeg-turbo/jcsample.c 3
/src/libjpeg-turbo/jcprepct.c 4
/src/libjpeg-turbo/simd/x86_64/jsimd.c 11
/src/libjpeg-turbo/jclossls.c 3
/src/libjpeg-turbo/jclhuff.c 1
/src/libjpeg-turbo/jcdiffct.c 3
/src/libjpeg-turbo/jcdctmgr.c 2
/src/libjpeg-turbo/jcarith.c 1
/src/libjpeg-turbo/jcphuff.c 1
/src/libjpeg-turbo/jchuff.c 1
/src/libjpeg-turbo/jccoefct.c 2
/src/libjpeg-turbo/jcmainct.c 3
/src/libjpeg-turbo/jcmarker.c 1
/src/leptonica/src/pngio.c 5
/src/libpng/pngwrite.c 14
/src/libpng/png.c 19
/src/libpng/pngmem.c 10
/src/libpng/pngerror.c 22
/src/libpng/pngwio.c 3
/src/zlib/deflate.c 16
/src/libpng/pngwutil.c 50
/src/libpng/pngset.c 10
/src/zlib/crc32.c 5
/src/zlib/adler32.c 2
/src/zlib/trees.c 20
/src/libpng/pngtrans.c 7
/src/libpng/pngwtran.c 5
/src/leptonica/src/tiffio.c 19
/src/libtiff/libtiff/tif_warning.c 2
/src/libtiff/libtiff/tif_error.c 4
/src/libtiff/libtiff/tif_open.c 10
/src/libtiff/libtiff/tif_unix.c 11
/src/libtiff/libtiff/tif_compress.c 2
/src/libtiff/libtiff/tif_swab.c 9
/src/libtiff/libtiff/tif_dir.c 10
/src/libtiff/libtiff/tif_dirinfo.c 12
/src/libtiff/libtiff/tif_aux.c 12
/src/libtiff/libtiff/tif_dirread.c 111
/src/libtiff/libtiff/tif_hash_set.c 13
/src/libtiff/libtiff/tif_codec.c 1
/src/libtiff/libtiff/tif_strip.c 6
/src/libtiff/libtiff/tif_tile.c 5
/src/libtiff/libtiff/tif_write.c 7
/src/libtiff/libtiff/tif_close.c 3
/src/libtiff/libtiff/tif_flush.c 3
/src/libtiff/libtiff/tif_dirwrite.c 69
/src/leptonica/src/pnmio.c 3
/src/leptonica/src/psio2.c 6
/src/leptonica/src/gifiostub.c 2
/src/leptonica/src/jp2kiostub.c 3
/src/leptonica/src/webpio.c 2
/src/libwebp/src/enc/picture_enc.c 14
/src/libwebp/src/enc/../../src/webp/encode.h 2
/src/libwebp/src/enc/config_enc.c 2
/src/libwebp/src/enc/webp_enc.c 12
/src/libwebp/src/enc/picture_csp_enc.c 21
/src/libwebp/src/dsp/alpha_processing.c 2
/src/libwebp/src/dsp/alpha_processing_sse2.c 1
/src/libwebp/src/dsp/alpha_processing_sse41.c 1
/src/libwebp/src/utils/utils.c 4
/src/libwebp/src/utils/../../src/utils/utils.h 2
/src/libwebp/sharpyuv/sharpyuv.c 20
/src/libwebp/sharpyuv/sharpyuv_dsp.c 1
/src/libwebp/sharpyuv/sharpyuv_sse2.c 1
/src/libwebp/sharpyuv/sharpyuv_gamma.c 32
/src/libwebp/sharpyuv/sharpyuv_csp.c 1
/src/libwebp/src/utils/random_utils.c 1
/src/libwebp/src/dsp/yuv.c 2
/src/libwebp/src/dsp/yuv_sse2.c 1
/src/libwebp/src/dsp/yuv_sse41.c 1
/src/libwebp/src/enc/../../src/dsp/yuv.h 4
/src/libwebp/src/enc/../../src/utils/random_utils.h 2
/src/libwebp/src/enc/picture_tools_enc.c 6
/src/libwebp/src/dsp/enc.c 4
/src/libwebp/src/dsp/dec.c 2
/src/libwebp/src/dsp/dec_clip_tables.c 1
/src/libwebp/src/dsp/dec_sse2.c 1
/src/libwebp/src/dsp/dec_sse41.c 1
/src/libwebp/src/dsp/enc_sse2.c 1
/src/libwebp/src/dsp/enc_sse41.c 1
/src/libwebp/src/enc/tree_enc.c 7
/src/libwebp/src/dsp/cost.c 2
/src/libwebp/src/dsp/cost_sse2.c 1
/src/libwebp/src/enc/alpha_enc.c 5
/src/libwebp/src/utils/thread_utils.c 1
/src/libwebp/src/enc/token_enc.c 8
/src/libwebp/src/enc/analysis_enc.c 9
/src/libwebp/src/enc/iterator_enc.c 23
/src/libwebp/src/enc/frame_enc.c 30
/src/libwebp/src/utils/bit_writer_utils.c 15
/src/libwebp/src/enc/syntax_enc.c 15
/src/libwebp/src/enc/quant_enc.c 36
/src/libwebp/src/enc/filter_enc.c 7
/src/libwebp/src/enc/../../src/enc/cost_enc.h 3
/src/libwebp/src/enc/cost_enc.c 7
/src/libwebp/src/enc/../../src/dsp/quant.h 2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h 1
/src/libwebp/src/dsp/ssim.c 2
/src/libwebp/src/dsp/ssim_sse2.c 1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h 5
/src/libwebp/src/enc/../../src/utils/utils.h 3
/src/libwebp/src/enc/vp8l_enc.c 17
/src/libwebp/src/dsp/lossless_enc.c 4
/src/libwebp/src/dsp/lossless.c 2
/src/libwebp/src/dsp/lossless_sse2.c 1
/src/libwebp/src/dsp/lossless_sse41.c 1
/src/libwebp/src/dsp/lossless_enc_sse2.c 1
/src/libwebp/src/dsp/lossless_enc_sse41.c 1
/src/libwebp/src/enc/backward_references_enc.c 5
/src/libwebp/src/utils/palette.c 2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h 1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h 3
/src/libwebp/src/enc/histogram_enc.c 2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h 1
/src/libwebp/src/enc/picture_rescale_enc.c 4
/src/leptonica/src/pdfio1.c 5
/src/leptonica/src/colorcontent.c 1
/src/leptonica/src/dnafunc1.c 4
/src/leptonica/src/dnabasic.c 17
/src/leptonica/src/hashmap.c 4
/src/leptonica/src/pdfio2.c 28
/src/libjpeg-turbo/jdapimin.c 5
/src/libjpeg-turbo/jdmarker.c 2
/src/libjpeg-turbo/jdinput.c 1
/src/libjpeg-turbo/jdatasrc.c 1
/src/libjpeg-turbo/jdmaster.c 3
/src/leptonica/src/bbuffer.c 6
/src/leptonica/src/encoding.c 2
/src/leptonica/src/jp2kheader.c 5
/src/leptonica/src/readfile.c 3
/src/leptonica/src/zlibmem.c 1
/src/leptonica/src/ptra.c 11
/src/leptonica/src/ptabasic.c 20
/src/leptonica/src/numafunc1.c 8
/src/leptonica/src/conncomp.c 15
/src/leptonica/src/stack.c 6
/src/leptonica/src/paintcmap.c 1
/src/leptonica/src/seedfill.c 4
/src/leptonica/src/compare.c 5
/src/leptonica/src/skew.c 7
/src/leptonica/src/shear.c 7
/src/leptonica/src/rotate.c 3
/src/leptonica/src/rotateshear.c 4
/src/leptonica/src/rotateam.c 4
/src/leptonica/src/rotateorth.c 1
/src/leptonica/src/pixafunc1.c 4
/src/leptonica/src/boxfunc4.c 1
/src/leptonica/src/morphapp.c 2
/src/leptonica/src/ccbord.c 6
/src/leptonica/src/ptafunc1.c 2
/src/leptonica/src/graphics.c 10
/src/leptonica/src/ptafunc2.c 1
/src/leptonica/src/map.c 4
/src/leptonica/src/rbtree.c 20
/src/leptonica/src/pixcomp.c 12
/src/leptonica/src/boxfunc2.c 9
/src/leptonica/src/numafunc2.c 1

Fuzzer: pixa_recog_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 8769 77.6%
gold [1:9] 48 0.42%
yellow [10:29] 36 0.31%
greenyellow [30:49] 41 0.36%
lawngreen 50+ 2398 21.2%
All colors 11292 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
11661 11721 2 :

['pixaConvertToPdf', 'pixaDestroy']