High level conclusions

Fuzzers reach 55.77% of cyclomatic complexity.

Fuzzers reach 50.78% of all functions.

Fuzzer binarize_fuzzer is blocked:

The runtime code coverage of binarize_fuzzer covers 12.73% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dewarp_fuzzer is blocked:

The runtime code coverage of dewarp_fuzzer covers 13.21% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer blend_fuzzer is blocked:

The runtime code coverage of blend_fuzzer covers 11.22% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc_fuzzer is blocked:

The runtime code coverage of boxfunc_fuzzer covers 0.555% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer barcode_fuzzer is blocked:

The runtime code coverage of barcode_fuzzer covers 15.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bilinear_fuzzer is blocked:

The runtime code coverage of bilinear_fuzzer covers 7.911% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer morph_fuzzer is blocked:

The runtime code coverage of morph_fuzzer covers 8.138% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer finditalic_fuzzer is blocked:

The runtime code coverage of finditalic_fuzzer covers 17.45% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer enhance_fuzzer is blocked:

The runtime code coverage of enhance_fuzzer covers 26.23% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer compare_fuzzer is blocked:

The runtime code coverage of compare_fuzzer covers 5.782% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ccthin_fuzzer is blocked:

The runtime code coverage of ccthin_fuzzer covers 2.678% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix_orient_fuzzer is blocked:

The runtime code coverage of pix_orient_fuzzer covers 7.992% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer edge_fuzzer is blocked:

The runtime code coverage of edge_fuzzer covers 4.163% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix4_fuzzer is blocked:

The runtime code coverage of pix4_fuzzer covers 11.20% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer checkerboard_fuzzer is blocked:

The runtime code coverage of checkerboard_fuzzer covers 14.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc5_fuzzer is blocked:

The runtime code coverage of boxfunc5_fuzzer covers 0.550% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer recog_basic_fuzzer is blocked:

The runtime code coverage of recog_basic_fuzzer covers 0.772% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer graphics_fuzzer is blocked:

The runtime code coverage of graphics_fuzzer covers 16.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pixconv_fuzzer is blocked:

The runtime code coverage of pixconv_fuzzer covers 8.430% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer classapp_fuzzer is blocked:

The runtime code coverage of classapp_fuzzer covers 10.21% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix3_fuzzer is blocked:

The runtime code coverage of pix3_fuzzer covers 6.279% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc3_fuzzer is blocked:

The runtime code coverage of boxfunc3_fuzzer covers 0.510% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc4_fuzzer is blocked:

The runtime code coverage of boxfunc4_fuzzer covers 0.802% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer adaptmap_fuzzer is blocked:

The runtime code coverage of adaptmap_fuzzer covers 7.852% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pixa_recog_fuzzer is blocked:

The runtime code coverage of pixa_recog_fuzzer covers 29.84% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer morphapp_fuzzer is blocked:

The runtime code coverage of morphapp_fuzzer covers 8.407% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer mask_fuzzer is blocked:

The runtime code coverage of mask_fuzzer covers 12.68% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer baseline_fuzzer is blocked:

The runtime code coverage of baseline_fuzzer covers 12.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer colorquant_fuzzer is blocked:

The runtime code coverage of colorquant_fuzzer covers 24.50% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer flipdetect_fuzzer is blocked:

The runtime code coverage of flipdetect_fuzzer covers 8.939% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer affine_fuzzer is blocked:

The runtime code coverage of affine_fuzzer covers 6.594% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3314 / 6525

Cyclomatic complexity statically reachable by fuzzers

37047 / 66417

Runtime code coverage of functions

2091 / 6525

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: affine_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5350	96.4%
gold	[1:9]	4	0.07%
yellow	[10:29]	6	0.10%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	186	3.35%
All colors	5549	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00710	/src/leptonica/src/readfile.c:197
7042	7806	13 : View List ['ptaGetIPt', 'pixCopy', 'pixClone', 'pixHShearIP', 'pixVShearIP', 'atan2', 'pixDestroy', 'pixScale', 'pixAddBorderGeneral', 'pixRasteropIP', 'lept_stderr', 'ptaGetCount', 'pixRemoveBorderGeneral']	7042	7834	pixAffineSequential	call site: 04959	/src/leptonica/src/affine.c:1459
2547	4368	9 : View List ['pixAffinePtaColor', 'pixClone', 'pixRemoveColormap', 'pixAffineSampledPta', 'pixDestroy', 'pixAffinePtaGray', 'pixGetDepth', 'pixConvertTo8', 'ptaGetCount']	2547	4375	pixAffinePta	call site: 00146	/src/leptonica/src/affine.c:438
1233	1244	4 : View List ['free', 'getAffineXformCoeffs', 'pixAffineColor', 'ptaGetCount']	1233	1251	pixAffinePtaColor	call site: 00634	/src/leptonica/src/affine.c:559
446	457	4 : View List ['pixAffineGray', 'getAffineXformCoeffs', 'ptaGetCount', 'free']	446	464	pixAffinePtaGray	call site: 00609	/src/leptonica/src/affine.c:658
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00429	/src/leptonica/src/roplow.c:569
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00729	/src/leptonica/src/utils2.c:3163
24	24	1 : View List ['pixSetAll']	24	1500	pixAffinePtaWithAlpha	call site: 04911	/src/leptonica/src/affine.c:811
11	11	1 : View List ['pixcmapGetCount']	11	60	pixSetAllArbitrary	call site: 00321	/src/leptonica/src/pix2.c:942
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04883	/src/leptonica/src/pix2.c:1792
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00713	/src/leptonica/src/utils2.c:3102
0	48	1 : View List ['pixSetAllArbitrary']	0	420	pixAddBorderGeneral	call site: 04890	/src/leptonica/src/pix2.c:1907

Runtime coverage analysis

Covered functions

78

Functions that are reachable but not covered

1119

Reachable functions

1198

Percentage of reachable functions covered

6.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/affine_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	21
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/affine.c	15
/src/leptonica/src/utils2.c	13
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/rop.c	4
/src/leptonica/src/roplow.c	10
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	7
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pix5.c	1
/src/leptonica/src/shear.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3

Fuzzer: flipdetect_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6862	93.5%
gold	[1:9]	7	0.09%
yellow	[10:29]	29	0.39%
greenyellow	[30:49]	4	0.05%
lawngreen	50+	435	5.92%
All colors	7337	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphSequence	call site: 07066	/src/leptonica/src/morphseq.c:243
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphCompSequence	call site: 06586	/src/leptonica/src/morphseq.c:409
10464	10464	1 : View List ['pixWrite']	10464	10464	pixWriteDebug	call site: 07084	/src/leptonica/src/writefile.c:309
1253	14596	9 : View List ['pixMorphSequence', 'boxaGetBox', 'pixConnComp', 'boxaGetCount', 'boxGetGeometry', 'boxDestroy', 'boxaDestroy', 'pixRasterop', 'pixCreateTemplate']	1255	58007	pixUpDownDetect	call site: 07108	/src/leptonica/src/flipdetect.c:608
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00598	/src/leptonica/src/pix2.c:2038
938	938	1 : View List ['pixCloseCompBrick']	938	938	pixCloseSafeCompBrick	call site: 00978	/src/leptonica/src/morph.c:1667
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00536	/src/leptonica/src/roplow.c:569
75	75	1 : View List ['pixaCreate']	29621	33504	pixMorphSequence	call site: 06943	/src/leptonica/src/morphseq.c:166
75	75	1 : View List ['pixaCreate']	28370	34224	pixMorphCompSequence	call site: 00418	/src/leptonica/src/morphseq.c:332
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00511	/src/leptonica/src/pix2.c:1907
32	39	2 : View List ['sarrayExtendArray', 'returnErrorInt']	32	67	sarrayAddString	call site: 00253	/src/leptonica/src/sarray1.c:449
24	141	10 : View List ['pixGetWpl', 'pixdata_malloc', 'returnErrorInt', 'pixSetWidth', 'pixSetWpl', 'pixFreeAndSetData', 'pixSetHeight', 'pixGetDimensions', 'pixSetDepth', 'pixCopyResolution']	24	141	pixResizeImageData	call site: 00196	/src/leptonica/src/pix1.c:762

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

1426

Reachable functions

1566

Percentage of reachable functions covered

8.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/flipdetect_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/utils2.c	30
/src/leptonica/src/flipdetect.c	6
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/sel1.c	10
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/morph.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	17
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/rotateorth.c	8

Fuzzer: fhmtgen_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	481	65.5%
gold	[1:9]	4	0.54%
yellow	[10:29]	6	0.81%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	243	33.1%
All colors	734	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00448	/src/leptonica/src/pix2.c:2038
238	238	2 : View List ['rasteropGeneralLow', 'rasteropVAlignedLow']	238	238	rasteropLow	call site: 00391	/src/leptonica/src/roplow.c:566
58	58	1 : View List ['selCopy']	101	152	selaAddSel	call site: 00167	/src/leptonica/src/sel1.c:562
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00367	/src/leptonica/src/pix2.c:1907
36	48	3 : View List ['selaExtendArray', 'returnErrorInt', 'selDestroy']	36	48	selaAddSel	call site: 00178	/src/leptonica/src/sel1.c:572
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 00359	/src/leptonica/src/pix2.c:1792
11	11	1 : View List ['pixClone']	11	11	pixRemoveBorder	call site: 00433	/src/leptonica/src/pix2.c:1996
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00296	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059

Runtime coverage analysis

Covered functions

95

Functions that are reachable but not covered

47

Reachable functions

143

Percentage of reachable functions covered

67.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/fhmtgen_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	16
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/sel2.c	1
/src/leptonica/src/sel1.c	15
/src/leptonica/src/utils2.c	4
/src/leptonica/src/fhmtgen.1.c	2
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/fhmtgenlow.1.c	11
/src/leptonica/src/pixconv.c	11

Fuzzer: colorquant_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6644	81.9%
gold	[1:9]	9	0.11%
yellow	[10:29]	20	0.24%
greenyellow	[30:49]	31	0.38%
lawngreen	50+	1406	17.3%
All colors	8110	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphSequence	call site: 06858	/src/leptonica/src/morphseq.c:243
10458	10458	1 : View List ['pixWriteDebug']	10458	11676	pixColorSegment	call site: 07774	/src/leptonica/src/colorseg.c:166
3876	3876	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5430	5588	pixScaleGeneral	call site: 00731	/src/leptonica/src/scale1.c:450
3866	3866	2 : View List ['pixScaleAreaMap2', 'pixScaleAreaMap']	3866	55806	pixColorsForQuantization	call site: 01522	/src/leptonica/src/colorcontent.c:1329
1923	1923	1 : View List ['pixScaleGrayLI']	3477	3635	pixScaleGeneral	call site: 00732	/src/leptonica/src/scale1.c:462
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1940	pixScaleColorLI	call site: 01147	/src/leptonica/src/scale1.c:605
1914	1914	1 : View List ['pixScaleColor2xLI']	1914	1914	pixScaleColorLI	call site: 01087	/src/leptonica/src/scale1.c:587
1914	1914	1 : View List ['pixScaleColor4xLI']	1914	1914	pixScaleColorLI	call site: 01088	/src/leptonica/src/scale1.c:589
1885	1890	2 : View List ['pixWriteJpeg', 'lept_stderr']	1885	1890	pixWriteImpliedFormat	call site: 07580	/src/leptonica/src/writefile.c:507
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 00732	/src/leptonica/src/scale1.c:467
1504	1504	1 : View List ['pixRotate3Shear']	1504	1504	pixRotateShear	call site: 07474	/src/leptonica/src/rotateshear.c:227
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01841	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

414

Functions that are reachable but not covered

1260

Reachable functions

1669

Percentage of reachable functions covered

24.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/colorquant_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	32
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	9
/src/leptonica/src/grayquant.c	12
/src/leptonica/src/pixconv.c	21
/src/leptonica/src/utils2.c	32
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/boxbasic.c	16
/src/leptonica/src/coloring.c	1
/src/leptonica/src/paintcmap.c	4
/src/leptonica/src/numabasic.c	20
/src/leptonica/src/scale1.c	29
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/colorquant1.c	23
/src/leptonica/src/colorquant2.c	16
/src/leptonica/src/colorcontent.c	4
/src/leptonica/src/heap.c	9
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/edge.c	1
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morph.c	15
/src/leptonica/src/sel1.c	9
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	10
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/skew.c	6
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/colorseg.c	6

Fuzzer: baseline_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8493	90.5%
gold	[1:9]	6	0.06%
yellow	[10:29]	6	0.06%
greenyellow	[30:49]	22	0.23%
lawngreen	50+	852	9.08%
All colors	9379	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11662	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11662	11736	pixMorphSequence	call site: 06858	/src/leptonica/src/morphseq.c:243
10464	10464	1 : View List ['pixWrite']	10464	10464	pixWriteDebug	call site: 09371	/src/leptonica/src/writefile.c:309
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 07146	/src/leptonica/src/readfile.c:197
4418	9270	9 : View List ['pixConvertTo8Or32', 'pixGetSpp', 'pixGetRGBComponent', 'returnErrorPtr', 'pixCopyRGBComponent', 'pixDestroy', 'pixGetDepth', 'pixUnsharpMaskingGray', 'pixCreateRGBImage']	4418	9270	pixUnsharpMasking	call site: 01640	/src/leptonica/src/enhance.c:993
3865	4198	18 : View List ['pixGetSpp', 'pixScaleAndTransferAlpha', 'pixConvertTo8', 'pixGetDepth', 'scaleGrayAreaMapLow', 'pixGetDimensions', 'pixCopyResolution', 'lept_stderr', 'pixGetWpl', 'pixGetData', 'returnErrorPtr', 'pixScaleResolution', 'pixClone', 'pixCopyInputFormat', 'pixGetColormap', 'pixRemoveColormap', 'scaleColorAreaMapLow', 'pixCreate']	3865	17979	pixScaleAreaMap	call site: 01930	/src/leptonica/src/scale1.c:1940
3846	3846	2 : View List ['pixScaleGrayLI', 'pixScaleColorLI']	3846	5558	pixScaleGeneral	call site: 01587	/src/leptonica/src/scale1.c:450
1933	1933	1 : View List ['pixScaleSmooth']	1933	3645	pixScaleGeneral	call site: 01587	/src/leptonica/src/scale1.c:451
1933	1933	1 : View List ['pixScaleSmooth']	1933	1938	pixScaleAreaMap	call site: 01595	/src/leptonica/src/scale1.c:1926
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1958	pixScaleAreaMap2	call site: 01952	/src/leptonica/src/scale1.c:2077
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01207	/src/leptonica/src/pix2.c:2038
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 01230	/src/leptonica/src/pix2.c:2488
1049	1049	1 : View List ['pixConvertTo8']	2967	3311	pixScaleAreaMap2	call site: 01937	/src/leptonica/src/scale1.c:2059

Runtime coverage analysis

Covered functions

257

Functions that are reachable but not covered

1856

Reachable functions

2113

Percentage of reachable functions covered

12.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/baseline_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	30
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/baseline.c	4
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/utils2.c	31
/src/leptonica/src/rop.c	2
/src/leptonica/src/roplow.c	10
/src/leptonica/src/skew.c	4
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/shear.c	5
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/ptafunc1.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/gplot.c	8
/src/leptonica/src/projective.c	4
/src/leptonica/src/affine.c	1
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/pixconv.c	17
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	21
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	5
/src/leptonica/src/graphics.c	5

Fuzzer: mask_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6924	91.3%
gold	[1:9]	9	0.11%
yellow	[10:29]	14	0.18%
greenyellow	[30:49]	2	0.02%
lawngreen	50+	627	8.27%
All colors	7576	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11662	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11662	11736	pixMorphSequence	call site: 06495	/src/leptonica/src/morphseq.c:243
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00664	/src/leptonica/src/pix2.c:2038
1089	1100	2 : View List ['pixGetSpp', 'pixGetRGBComponent']	3085	7795	pixBlendWithGrayMask	call site: 01593	/src/leptonica/src/blend.c:1714
998	1009	2 : View List ['pixClone', 'pixConvertTo32']	998	1820	pixBlendWithGrayMask	call site: 01605	/src/leptonica/src/blend.c:1743
907	907	1 : View List ['pixConvert2To8']	907	907	pixConvertTo8	call site: 00730	/src/leptonica/src/pixconv.c:3075
907	907	1 : View List ['pixConvert4To8']	907	907	pixConvertTo8	call site: 00731	/src/leptonica/src/pixconv.c:3077
886	886	1 : View List ['pixCloseBrick']	886	886	pixCloseSafeBrick	call site: 00581	/src/leptonica/src/morph.c:973
829	829	1 : View List ['pixClose']	829	2611	pixCloseSafeBrick	call site: 00610	/src/leptonica/src/morph.c:980
829	829	1 : View List ['pixOpen']	829	907	pixOpenBrick	call site: 00544	/src/leptonica/src/morph.c:825
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 06860	/src/leptonica/src/compare.c:278
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 07124	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 07140	/src/leptonica/src/pixconv.c:1892

Runtime coverage analysis

Covered functions

203

Functions that are reachable but not covered

1397

Reachable functions

1600

Percentage of reachable functions covered

12.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/mask_fuzzer.cc	2
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	15
/src/leptonica/src/colorcontent.c	2
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	6
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/seedfill.c	6
/src/leptonica/src/compare.c	5
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/numafunc2.c	3
/src/leptonica/src/rotateorth.c	5

Fuzzer: bilateral_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1044	78.5%
gold	[1:9]	18	1.35%
yellow	[10:29]	14	1.05%
greenyellow	[30:49]	21	1.58%
lawngreen	50+	232	17.4%
All colors	1329	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00523	/src/leptonica/src/pix2.c:2488
318	318	1 : View List ['pixcmapGetRangeValues']	318	318	pixGetExtremeValue	call site: 01077	/src/leptonica/src/pix4.c:2189
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00311	/src/leptonica/src/roplow.c:569
58	98	3 : View List ['pixaExtendArray', 'returnErrorInt', 'pixDestroy']	58	98	pixaAddPix	call site: 01134	/src/leptonica/src/pixabasic.c:517
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 01063	/src/leptonica/src/pix2.c:1907
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00177	/src/leptonica/src/utils2.c:352
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	kernelSetElement	call site: 01244	/src/leptonica/src/kernel.c:248
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00163	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

109

Reachable functions

210

Percentage of reachable functions covered

48.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/bilateral_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	14
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	4
/src/leptonica/src/bilateral.c	9
/src/leptonica/src/scale1.c	26
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/pixabasic.c	10
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/kernel.c	11

Fuzzer: morphapp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9167	94.9%
gold	[1:9]	5	0.05%
yellow	[10:29]	10	0.10%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	472	4.88%
All colors	9655	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00135	/src/leptonica/src/readfile.c:197
4804	5184	10 : View List ['pixErode', 'pixDilate', 'selaGetSel', 'pixAnd', 'pixClose', 'pixOpen', 'pixDestroy', 'pixCreateTemplate', 'pixSetAll', 'pixHMT']	4804	5191	pixIntersectionOfMorphOps	call site: 05783	/src/leptonica/src/morphapp.c:558
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 05678	/src/leptonica/src/convolve.c:167
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1918	pixScaleBySamplingWithShift	call site: 05622	/src/leptonica/src/scale1.c:1385
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 09584	/src/leptonica/src/compare.c:267
1657	3741	10 : View List ['selSetElement', 'selDestroy', 'pixCopy', 'selCreateBrick', 'pixDilate', 'pixAnd', 'pixDestroy', 'pixEqual', 'pixCreateTemplate', 'lept_stderr']	1657	3748	pixSeedfillMorph	call site: 09501	/src/leptonica/src/morphapp.c:1035
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 05928	/src/leptonica/src/pix2.c:2038
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 09587	/src/leptonica/src/compare.c:278
425	425	1 : View List ['pixScaleBinaryWithShift']	425	425	pixScaleBySamplingWithShift	call site: 05605	/src/leptonica/src/scale1.c:1365
110	110	2 : View List ['pixcmapGetColor', 'pixGetPixel']	110	110	pixEqualWithCmap	call site: 09533	/src/leptonica/src/compare.c:416
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 02161	/src/leptonica/src/roplow.c:569
48	48	1 : View List ['pixAlphaIsOpaque']	10080	11053	pixEqualWithAlpha	call site: 09517	/src/leptonica/src/compare.c:218

Runtime coverage analysis

Covered functions

180

Functions that are reachable but not covered

1950

Reachable functions

2129

Percentage of reachable functions covered

8.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/morphapp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	30
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/morphapp.c	13
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	14
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/scale2.c	25
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	5
/src/leptonica/src/grayquant.c	7
/src/leptonica/src/seedfill.c	5
/src/leptonica/src/queue.c	6
/src/leptonica/src/sel1.c	13
/src/leptonica/src/morph.c	19
/src/leptonica/src/graymorph.c	2
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	19
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/compare.c	5

Fuzzer: paintcmap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	151	54.3%
gold	[1:9]	4	1.43%
yellow	[10:29]	11	3.95%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	40.2%
All colors	278	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00184	/src/leptonica/src/utils2.c:352
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	2	24	boxCreate	call site: 00135	/src/leptonica/src/boxbasic.c:186
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateTemplate	call site: 00145	/src/leptonica/src/pix1.c:387
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateTemplateNoInit	call site: 00148	/src/leptonica/src/pix1.c:421
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	7	1 : View List ['returnErrorPtr']	0	7	pixCopy	call site: 00143	/src/leptonica/src/pix1.c:705
0	7	1 : View List ['returnErrorInt']	0	7	pixCopyColormap	call site: 00170	/src/leptonica/src/pix1.c:819
0	7	1 : View List ['returnErrorInt']	0	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

9

Reachable functions

78

Percentage of reachable functions covered

88.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/paintcmap_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	40
/src/leptonica/src/colormap.c	9
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/utils2.c	3
/src/leptonica/src/paintcmap.c	2

Fuzzer: pixa_recog_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8747	77.6%
gold	[1:9]	46	0.40%
yellow	[10:29]	38	0.33%
greenyellow	[30:49]	38	0.33%
lawngreen	50+	2401	21.3%
All colors	11270	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11662	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11662	11736	pixMorphSequence	call site: 09028	/src/leptonica/src/morphseq.c:243
3876	3876	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5430	5588	pixScaleGeneral	call site: 05942	/src/leptonica/src/scale1.c:450
3841	4129	12 : View List ['pixGetWpl', 'pixGetSpp', 'pixGetData', 'returnErrorPtr', 'pixScaleResolution', 'pixCopyInputFormat', 'pixScaleAndTransferAlpha', 'pixCreate', 'pixScaleColor4xLI', 'pixGetDimensions', 'scaleColorLILow', 'pixCopyResolution']	3841	4129	pixScaleColorLI	call site: 06179	/src/leptonica/src/scale1.c:587
2952	7561	24 : View List ['pixaAddPix', 'pixaGetDepthInfo', 'boxCreate', 'pixaSetBoxa', 'pixSetResolution', 'pixDestroy', 'pixScale', 'pixaCreate', 'pixaDisplay', 'pixaGetPix', 'lept_stderr', 'boxaAddBox', 'boxaWriteMem', 'pixaGetPixDimensions', 'boxaCreate', 'pixClone', 'pixaDestroy', 'pixaConvertToSameDepth', 'pixSetText', 'boxaGetExtent', 'pixGetXRes', 'pixAddBorder', 'pixaGetCount', 'free']	2952	7568	pixaDisplayTiledInColumns	call site: 10903	/src/leptonica/src/pixafunc2.c:930
2588	25161	5 : View List ['selaDisplayInPix', 'pixDisplay', 'pixWrite', 'lept_mkdir', 'pixDestroy']	2588	25178	selaMakeThinSets	call site: 09789	/src/leptonica/src/ccthin.c:455
1923	1923	1 : View List ['pixScaleGrayLI']	3477	3635	pixScaleGeneral	call site: 05943	/src/leptonica/src/scale1.c:462
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1940	pixScaleColor2xLI	call site: 06190	/src/leptonica/src/scale1.c:648
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 05943	/src/leptonica/src/scale1.c:467
1392	3666	4 : View List ['pixInvert', 'pixSubtract', 'pixExtractBorderConnComps', 'pixDestroy']	1392	3726	pixThinConnectedBySet	call site: 09932	/src/leptonica/src/ccthin.c:295
1323	1323	1 : View List ['TIFFFlush']	1331	1466	TIFFCleanup	call site: 03107	/src/libtiff/libtiff/tif_close.c:49
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04939	/src/leptonica/src/pix2.c:2038
1085	1125	3 : View List ['pixConvert16To8', 'pixConvert8To32', 'pixDestroy']	1085	1125	pixConvertTo32	call site: 06427	/src/leptonica/src/pixconv.c:3271

Runtime coverage analysis

Covered functions

722

Functions that are reachable but not covered

1634

Reachable functions

2329

Percentage of reachable functions covered

29.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pixa_recog_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	11
/src/leptonica/src/pixabasic.c	33
/src/leptonica/src/utils2.c	31
/src/leptonica/src/boxbasic.c	34
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	54
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/pix2.c	34
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	14
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/recogbasic.c	9
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	6
/src/leptonica/src/readfile.c	6
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/tiffio.c	20
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numabasic.c	27
/src/leptonica/src/pix5.c	8
/src/leptonica/src/boxfunc1.c	7
/src/leptonica/src/morph.c	12
/src/leptonica/src/sel1.c	23
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	9
/src/leptonica/src/numafunc1.c	14
/src/leptonica/src/ptra.c	11
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/recogtrain.c	15
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	27
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	4
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	19
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/compare.c	5
/src/leptonica/src/recogident.c	14
/src/leptonica/src/recogdid.c	12
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/strokes.c	2
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	3
/src/leptonica/src/graphics.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc1.c	7
/src/leptonica/src/correlscore.c	1
/src/leptonica/src/textops.c	6
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/boxfunc4.c	1

Fuzzer: adaptmap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9031	93.0%
gold	[1:9]	3	0.03%
yellow	[10:29]	9	0.09%
greenyellow	[30:49]	3	0.03%
lawngreen	50+	658	6.78%
All colors	9704	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphSequence	call site: 08449	/src/leptonica/src/morphseq.c:243
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00135	/src/leptonica/src/readfile.c:197
4638	6640	3 : View List ['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']	4638	6730	pixGetBackgroundRGBMap	call site: 09317	/src/leptonica/src/adaptmap.c:1207
4638	4678	2 : View List ['pixSmoothConnectedRegions', 'pixDestroy']	4638	4768	pixGetBackgroundRGBMapMorph	call site: 09225	/src/leptonica/src/adaptmap.c:1426
3694	3694	3 : View List ['pixScale', 'pixConvertTo8', 'pixAnd']	5240	5937	pixGetBackgroundGrayMapMorph	call site: 09131	/src/leptonica/src/adaptmap.c:1283
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 09045	/src/leptonica/src/convolve.c:167
2960	2960	2 : View List ['pixScale', 'pixConvertTo8']	9800	18680	pixGetBackgroundRGBMapMorph	call site: 09190	/src/leptonica/src/adaptmap.c:1367
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1918	pixScaleBySamplingWithShift	call site: 08769	/src/leptonica/src/scale1.c:1385
1546	3548	3 : View List ['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']	1546	3578	pixGetBackgroundGrayMap	call site: 08732	/src/leptonica/src/adaptmap.c:1018
1546	1546	1 : View List ['pixSmoothConnectedRegions']	1546	1616	pixGetBackgroundGrayMapMorph	call site: 09150	/src/leptonica/src/adaptmap.c:1304
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04840	/src/leptonica/src/pix2.c:2038
734	1518	3 : View List ['pixRasterop', 'pixAnd', 'pixDestroy']	734	1518	pixCombineMasked	call site: 09593	/src/leptonica/src/pix3.c:411

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

1948

Reachable functions

2114

Percentage of reachable functions covered

7.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/adaptmap_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	7
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	30
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/adaptmap.c	24
/src/leptonica/src/grayquant.c	4
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	19
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	30
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	3
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/graymorph.c	3
/src/leptonica/src/numafunc2.c	1
/src/leptonica/src/edge.c	2
/src/leptonica/src/seedfill.c	2

Fuzzer: boxfunc4_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6624	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.18%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	6638	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', 'boxaCreate', 'boxCreate', 'boxaDestroy', '__isoc99_fscanf', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1359

Reachable functions

1370

Percentage of reachable functions covered

0.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc4_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/boxbasic.c	25
/src/leptonica/src/utils2.c	17
/src/leptonica/src/boxfunc4.c	11
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	4
/src/leptonica/src/readfile.c	5
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	8
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	3
/src/libpng/pngread.c	12
/src/libpng/png.c	52
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	12
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	3
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/ptra.c	9
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/graphics.c	6
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3

Fuzzer: jpegiostub_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	63	45.3%
gold	[1:9]	4	2.87%
yellow	[10:29]	6	4.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	66	47.4%
All colors	139	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	5	1 : View List ['lept_stderr']	0	5	pixcmapDestroy	call site: 00057	/src/leptonica/src/colormap.c:276
0	0	None	14	140	pixcmapIsValid	call site: 00096	/src/leptonica/src/colormap.c:314
0	0	None	14	94	pixGetMaxColorIndex	call site: 00109	/src/leptonica/src/pix4.c:2379

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

3

Reachable functions

45

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/jpegiostub_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/jpegio.c	1

Fuzzer: boxfunc3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9613	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.12%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	9627	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', 'boxaCreate', 'boxCreate', 'boxaDestroy', '__isoc99_fscanf', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

2144

Reachable functions

2155

Percentage of reachable functions covered

0.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc3_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/boxbasic.c	32
/src/leptonica/src/utils2.c	31
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	26
/src/leptonica/src/pix2.c	34
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/boxfunc2.c	6
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/ptra.c	11
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/boxfunc1.c	6
/src/leptonica/src/boxfunc3.c	7
/src/leptonica/src/graphics.c	8
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/pageseg.c	1
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1

Fuzzer: pix3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9257	95.6%
gold	[1:9]	3	0.03%
yellow	[10:29]	33	0.34%
greenyellow	[30:49]	10	0.10%
lawngreen	50+	380	3.92%
All colors	9683	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16181	17199	6 : View List ['pixDisplayLayersRGBA', 'pixGetRGBComponent', 'pixSetMasked', 'pixDisplay', 'pixThresholdToBinary', 'pixDestroy']	16181	17576	pixSetUnderTransparency	call site: 09619	/src/leptonica/src/pix3.c:1198
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00729	/src/leptonica/src/readfile.c:197
148	176	3 : View List ['pixGetDimensions', 'pixGetColormap', 'pixGetPixel']	148	197	pixAbsDiffOnLine	call site: 00321	/src/leptonica/src/pix3.c:3195
143	1856	22 : View List ['composeRGBPixel', 'pixInvert', 'composeRGBAPixel', 'pixCreate', 'pixGetDimensions', 'pixSetSpp', 'pixcmapGetColor', 'pixCopyResolution', 'lept_stderr', 'pixGetWpl', 'pixGetData', 'returnErrorPtr', 'pixCopy', 'pixDestroyColormap', 'pixCopyInputFormat', 'calloc', 'pixcmapToArrays', 'pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'free', 'pixcmapIsOpaque', 'pixcmapGetCount']	143	1856	pixRemoveColormap	call site: 00643	/src/leptonica/src/pixconv.c:338
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00530	/src/leptonica/src/roplow.c:569
35	35	1 : View List ['rasteropUniGeneralLow']	35	35	rasteropUniLow	call site: 00521	/src/leptonica/src/roplow.c:178
33	40	2 : View List ['returnErrorInt', 'numaExtendArray']	33	40	numaAddNumber	call site: 00265	/src/leptonica/src/numabasic.c:469
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00748	/src/leptonica/src/utils2.c:3163
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00732	/src/leptonica/src/utils2.c:3102
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	28	1 : View List ['stringNew']	0	28	stringReplace	call site: 00184	/src/leptonica/src/utils2.c:352
0	25	2 : View List ['boxaDestroy', 'returnErrorPtr']	0	25	boxaCreate	call site: 00417	/src/leptonica/src/boxbasic.c:453

Runtime coverage analysis

Covered functions

132

Functions that are reachable but not covered

1985

Reachable functions

2118

Percentage of reachable functions covered

6.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix3_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	26
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	35
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/utils2.c	30
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/pix5.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/numafunc2.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	6
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6

Fuzzer: classapp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8878	92.3%
gold	[1:9]	21	0.21%
yellow	[10:29]	8	0.08%
greenyellow	[30:49]	6	0.06%
lawngreen	50+	702	7.30%
All colors	9615	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
23424	23615	8 : View List ['pixaAddPix', 'pixDestroy', 'lept_mkdir', 'pixScaleToSize', 'numaGetCount', 'numaMakeSequence', 'gplotGeneralPix2', 'lept_stderr']	23424	25435	pixWordMaskByDilation	call site: 06880	/src/leptonica/src/jbclass.c:1517
12574	12839	9 : View List ['boxaAdjustSides', 'stringJoin', 'pixWrite', 'pixDestroy', 'boxaaFlattenToBoxa', 'boxaDestroy', 'pixRenderBoxaArb', 'free', 'pixConvertTo32']	12574	12839	pixFindWordAndCharacterBoxes	call site: 09590	/src/leptonica/src/classapp.c:620
11895	12082	12 : View List ['pixConvertTo8Or32', 'returnErrorPtr', 'pixClone', 'pixCopyInputFormat', 'pixScaleSmooth', 'pixDestroy', 'pixScaleColorLI', 'pixUnsharpMasking', 'pixGetDepth', 'pixScaleGrayLI', 'pixScaleAreaMap', 'pixCopyText']	11895	12082	pixScaleGeneral	call site: 00529	/src/leptonica/src/scale1.c:439
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphSequence	call site: 06519	/src/leptonica/src/morphseq.c:243
2400	2400	3 : View List ['pixUnpackBinary', 'pixaAddPix', 'pixRenderBoxaArb']	2400	2476	pixWordBoxesByDilation	call site: 08982	/src/leptonica/src/jbclass.c:1605
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01425	/src/leptonica/src/pix2.c:2038
907	907	1 : View List ['pixConvert4To8']	907	907	pixConvertTo8	call site: 00309	/src/leptonica/src/pixconv.c:3077
764	1535	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	764	1535	pixConvertTo1	call site: 00492	/src/leptonica/src/pixconv.c:2968
764	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	764	1163	pixRemoveColormap	call site: 00349	/src/leptonica/src/pixconv.c:385
513	513	2 : View List ['pixConvert1To8Cmap', 'pixConvert1To8']	513	513	pixConvertTo8	call site: 00277	/src/leptonica/src/pixconv.c:3070
328	328	2 : View List ['stringReplaceSubstr', 'lept_mkdir']	24870	40855	pixFindWordAndCharacterBoxes	call site: 09535	/src/leptonica/src/classapp.c:563
209	350	4 : View List ['pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap', 'pixcmapAddColor']	209	350	pixConvert2To8	call site: 00392	/src/leptonica/src/pixconv.c:2468

Runtime coverage analysis

Covered functions

220

Functions that are reachable but not covered

1933

Reachable functions

2153

Percentage of reachable functions covered

10.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/classapp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	4
/src/leptonica/src/boxbasic.c	30
/src/leptonica/src/utils2.c	33
/src/leptonica/src/classapp.c	2
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	21
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	28
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/jbclass.c	2
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	21
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/gplot.c	8
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/leptonica/src/boxfunc4.c	4
/src/leptonica/src/graphics.c	7
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/boxfunc2.c	9

Fuzzer: pixconv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6672	94.3%
gold	[1:9]	8	0.11%
yellow	[10:29]	24	0.33%
greenyellow	[30:49]	12	0.16%
lawngreen	50+	355	5.02%
All colors	7071	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphSequence	call site: 06605	/src/leptonica/src/morphseq.c:243
3866	3866	2 : View List ['pixScaleAreaMap2', 'pixScaleAreaMap']	24794	55806	pixColorsForQuantization	call site: 00617	/src/leptonica/src/colorcontent.c:1329
1167	1221	2 : View List ['pixRemoveBorder', 'pixSwapAndDestroy']	12889	12957	pixMorphSequence	call site: 06604	/src/leptonica/src/morphseq.c:238
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00457	/src/leptonica/src/pix2.c:2488
913	913	1 : View List ['pixThresholdOn8bpp']	913	982	pixQuantizeIfFewColors	call site: 07061	/src/leptonica/src/pixconv.c:1691
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 06906	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 06921	/src/leptonica/src/pixconv.c:1892
116	363	4 : View List ['pixcmapIsValid', 'pixcmapCopy', 'returnErrorInt', 'pixSetColormap']	116	363	pixCopyColormap	call site: 00219	/src/leptonica/src/pix1.c:813
103	103	3 : View List ['pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'pixcmapIsOpaque']	165	1772	pixRemoveColormap	call site: 00181	/src/leptonica/src/pixconv.c:367
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00300	/src/leptonica/src/roplow.c:569
79	83	2 : View List ['extractRGBValues', 'pixSetMaskedCmap']	79	83	pixSetMasked	call site: 06879	/src/leptonica/src/pix3.c:177
75	75	1 : View List ['pixaCreate']	31886	33504	pixMorphSequence	call site: 01258	/src/leptonica/src/morphseq.c:166

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

1412

Reachable functions

1542

Percentage of reachable functions covered

8.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pixconv_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	5
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/grayquant.c	10
/src/leptonica/src/colorcontent.c	4
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/edge.c	1
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	14
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	19
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/colorquant1.c	4

Fuzzer: pix1_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	65	45.4%
gold	[1:9]	3	2.09%
yellow	[10:29]	6	4.19%
greenyellow	[30:49]	1	0.69%
lawngreen	50+	68	47.5%
All colors	143	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	31	4 : View List ['pixGetHeight', 'pixGetWpl', 'pixdata_malloc', 'returnErrorPtr']	0	42	pixExtractData	call site: 00134	/src/leptonica/src/pix1.c:1756
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	5	1 : View List ['lept_stderr']	0	5	pixcmapDestroy	call site: 00057	/src/leptonica/src/colormap.c:276
0	0	None	14	140	pixcmapIsValid	call site: 00096	/src/leptonica/src/colormap.c:314

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

3

Reachable functions

45

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix1_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/utils2.c	1

Fuzzer: graphics_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4928	89.2%
gold	[1:9]	3	0.05%
yellow	[10:29]	15	0.27%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	570	10.3%
All colors	5519	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 01147	/src/leptonica/src/readfile.c:197
2925	3363	12 : View List ['pixSetPixel', 'calloc', 'pixDestroy', 'pixFindHorizontalRuns', 'pixInvert', 'ptaPtInsidePolygon', 'pixCreateTemplate', 'free', 'pixGetDimensions', 'pixSeedfillBinary', 'pixOr', 'lept_stderr']	2925	3370	pixFillPolygon	call site: 00144	/src/leptonica/src/graphics.c:2490
847	1745	11 : View List ['boxCreate', 'ptaDestroy', 'boxDestroy', 'pixDestroy', 'pixRasterop', 'ptaCropToMask', 'pixClipRectangle', 'pixRenderPtaArb', 'generatePtaHashBox', 'pixGetDimensions', 'lept_stderr']	847	1759	pixRenderHashMaskArb	call site: 05281	/src/leptonica/src/graphics.c:1973
728	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	728	1163	pixRemoveColormap	call site: 00409	/src/leptonica/src/pixconv.c:385
103	103	3 : View List ['pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'pixcmapIsOpaque']	846	1772	pixRemoveColormap	call site: 00399	/src/leptonica/src/pixconv.c:367
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00283	/src/leptonica/src/roplow.c:569
60	60	1 : View List ['generatePtaFilledSquare']	60	802	makePlotPtaFromNumaGen	call site: 05375	/src/leptonica/src/graphics.c:1173
39	57	3 : View List ['returnErrorInt', 'boxDestroy', 'boxaExtendArray']	39	57	boxaAddBox	call site: 01012	/src/leptonica/src/boxbasic.c:577
34	45	2 : View List ['boxClone', 'boxCopy']	73	127	boxaAddBox	call site: 01007	/src/leptonica/src/boxbasic.c:565
34	34	1 : View List ['boxCopy']	34	34	boxaGetBox	call site: 00887	/src/leptonica/src/boxbasic.c:711
33	40	2 : View List ['returnErrorInt', 'numaExtendArray']	33	40	numaAddNumber	call site: 05343	/src/leptonica/src/numabasic.c:469
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 01166	/src/leptonica/src/utils2.c:3163

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

1024

Reachable functions

1221

Percentage of reachable functions covered

16.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/graphics_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	8
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	12
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/graphics.c	32
/src/leptonica/src/runlength.c	1
/src/leptonica/src/ptafunc1.c	6
/src/leptonica/src/utils2.c	13
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixconv.c	15
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/morph.c	3
/src/leptonica/src/sel1.c	7
/src/leptonica/src/boxbasic.c	13
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	7
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/pix5.c	1
/src/leptonica/src/enhance.c	1
/src/leptonica/src/numafunc1.c	2

Fuzzer: maze_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	337	58.6%
gold	[1:9]	24	4.17%
yellow	[10:29]	5	0.86%
greenyellow	[30:49]	2	0.34%
lawngreen	50+	207	36.0%
All colors	575	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1141	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	1141	1163	pixRemoveColormap	call site: 00435	/src/leptonica/src/pixconv.c:385
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 00214	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 00241	/src/leptonica/src/pixconv.c:1892
416	416	1 : View List ['pixConvert1To8']	416	438	pixUnpackBinary	call site: 00260	/src/leptonica/src/pixconv.c:1897
416	416	1 : View List ['pixConvert1To16']	416	438	pixUnpackBinary	call site: 00279	/src/leptonica/src/pixconv.c:1902
103	103	3 : View List ['pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'pixcmapIsOpaque']	1259	1772	pixRemoveColormap	call site: 00424	/src/leptonica/src/pixconv.c:367
34	34	1 : View List ['lstackDestroy']	34	34	lqueueDestroy	call site: 00169	/src/leptonica/src/queue.c:156
11	11	1 : View List ['pixClone']	11	11	pixRemoveColormap	call site: 00408	/src/leptonica/src/pixconv.c:338
7	18	2 : View List ['returnErrorInt', 'pixcmapGetCount']	7	18	pixSetAll	call site: 00357	/src/leptonica/src/pix2.c:806
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	lheapAdd	call site: 00380	/src/leptonica/src/heap.c:199
7	7	1 : View List ['returnErrorInt']	7	7	lheapExtendArray	call site: 00380	/src/leptonica/src/heap.c:225

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

41

Reachable functions

124

Percentage of reachable functions covered

66.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/maze_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	40
/src/leptonica/src/colormap.c	12
/src/leptonica/src/pix2.c	6
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/maze.c	4
/src/leptonica/src/queue.c	6
/src/leptonica/src/stack.c	2
/src/leptonica/src/utils2.c	4
/src/leptonica/src/pixconv.c	8
/src/leptonica/src/ptabasic.c	4
/src/leptonica/src/heap.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7

Fuzzer: fpix2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	362	50.7%
gold	[1:9]	7	0.98%
yellow	[10:29]	5	0.70%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	338	47.4%
All colors	713	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1141	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	1141	1163	pixRemoveColormap	call site: 00171	/src/leptonica/src/pixconv.c:385
103	103	3 : View List ['pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'pixcmapIsOpaque']	1270	1772	pixRemoveColormap	call site: 00155	/src/leptonica/src/pixconv.c:367
33	33	2 : View List ['ptaClone', 'fpixClone']	33	379	fpixProjectivePta	call site: 00668	/src/leptonica/src/fpix2.c:2084
33	33	2 : View List ['ptaClone', 'fpixClone']	33	377	fpixAffinePta	call site: 00531	/src/leptonica/src/fpix2.c:1969
22	35	3 : View List ['composeRGBPixel', 'composeRGBAPixel', 'pixSetSpp']	24	262	pixRemoveColormap	call site: 00290	/src/leptonica/src/pixconv.c:397
0	83	1 : View List ['fpixCopy']	0	83	fpixAddBorder	call site: 00498	/src/leptonica/src/fpix2.c:1369
0	83	1 : View List ['fpixCopy']	0	83	fpixRemoveBorder	call site: 00623	/src/leptonica/src/fpix2.c:1403
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	11	1 : View List ['pixClone']	0	11	pixRemoveColormap	call site: 00138	/src/leptonica/src/pixconv.c:338
0	10	1 : View List ['lept_stderr']	0	180	dpixConvertToPix	call site: 00419	/src/leptonica/src/fpix2.c:576
0	7	1 : View List ['returnErrorPtr']	0	47	pixConvertToDPix	call site: 00331	/src/leptonica/src/fpix2.c:247
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450

Runtime coverage analysis

Covered functions

112

Functions that are reachable but not covered

42

Reachable functions

156

Percentage of reachable functions covered

73.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/fpix2_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	12
/src/leptonica/src/pix2.c	3
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/fpix2.c	22
/src/leptonica/src/pixconv.c	3
/src/leptonica/src/utils2.c	4
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/fpix1.c	29
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/affine.c	3
/src/leptonica/src/projective.c	2

Fuzzer: ccbord_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	757	58.2%
gold	[1:9]	6	0.46%
yellow	[10:29]	10	0.76%
greenyellow	[30:49]	2	0.15%
lawngreen	50+	524	40.3%
All colors	1299	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 00958	/src/leptonica/src/compare.c:267
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 00961	/src/leptonica/src/compare.c:278
72	72	1 : View List ['ptaCopy']	72	72	ptaaGetPta	call site: 01133	/src/leptonica/src/ptabasic.c:1074
48	48	1 : View List ['pixAlphaIsOpaque']	10080	11053	pixEqualWithAlpha	call site: 00661	/src/leptonica/src/compare.c:218
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00547	/src/leptonica/src/pix2.c:1907
36	110	2 : View List ['pixcmapGetColor', 'pixGetPixel']	36	110	pixEqualWithCmap	call site: 00685	/src/leptonica/src/compare.c:416
29	36	2 : View List ['ccbaExtendArray', 'returnErrorInt']	29	36	ccbaAddCcb	call site: 01056	/src/leptonica/src/ccbord.c:467
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00197	/src/leptonica/src/utils2.c:352
24	141	10 : View List ['pixGetWpl', 'pixdata_malloc', 'returnErrorInt', 'pixSetWidth', 'pixSetWpl', 'pixFreeAndSetData', 'pixSetHeight', 'pixGetDimensions', 'pixSetDepth', 'pixCopyResolution']	24	141	pixResizeImageData	call site: 00216	/src/leptonica/src/pix1.c:762
18	18	1 : View List ['numaaDestroy']	18	40	ccbDestroy	call site: 00476	/src/leptonica/src/ccbord.c:433
0	388	2 : View List ['pixClone', 'pixCopy']	0	511	pixaAddPix	call site: 00423	/src/leptonica/src/pixabasic.c:505
0	377	1 : View List ['pixCopy']	0	377	pixaGetPix	call site: 00490	/src/leptonica/src/pixabasic.c:662

Runtime coverage analysis

Covered functions

166

Functions that are reachable but not covered

53

Reachable functions

218

Percentage of reachable functions covered

75.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/ccbord_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	10
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/ccbord.c	19
/src/leptonica/src/conncomp.c	9
/src/leptonica/src/boxbasic.c	15
/src/leptonica/src/utils2.c	4
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/ptabasic.c	16
/src/leptonica/src/numabasic.c	13
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/ptafunc1.c	4

Fuzzer: recog_basic_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9937	99.6%
gold	[1:9]	32	0.32%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.01%
All colors	9970	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
30149	30970	12 : View List ['l_dnaDestroy', 'sarrayReadStream', 'pixaaGetCount', 'recogAddAllSamples', 'pixaaDestroy', 'recogDestroy', 'pixaaReadStream', 'recogCreate', 'l_dnaReadStream', '__isoc99_fscanf', 'sarrayDestroy', 'lept_stderr']	30149	31068	recogReadStream	call site: 00065	/src/leptonica/src/recogbasic.c:860
944	944	14 : View List ['l_dnaDestroy', 'ptaaDestroy', 'recogDestroyDid', 'bmfDestroy', 'ptaDestroy', 'pixaDestroy', 'rchDestroy', 'pixaaDestroy', 'numaDestroy', 'pixDestroy', 'rchaDestroy', 'free', 'sarrayDestroy', 'numaaDestroy']	944	944	recogDestroy	call site: 05669	/src/leptonica/src/recogbasic.c:481
56	68	5 : View List ['returnErrorPtr1', 'fopen', 'free', 'lept_stderr', 'splitPathAtDirectory']	56	68	fopenReadStream	call site: 00049	/src/leptonica/src/utils2.c:1888
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00038	/src/leptonica/src/utils2.c:3163
7	7	1 : View List ['returnErrorInt']	7	7	convertSepCharsInPath	call site: 00028	/src/leptonica/src/utils2.c:3028
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00015	/src/leptonica/src/utils2.c:3102
0	7	1 : View List ['returnErrorPtr']	0	7	stringNew	call site: 00021	/src/leptonica/src/utils2.c:238
0	7	1 : View List ['returnErrorPtr']	0	7	genPathname	call site: 00033	/src/leptonica/src/utils2.c:3121
0	0	None	30151	31077	recogReadStream	call site: 00063	/src/leptonica/src/recogbasic.c:857
0	0	None	944	944	recogDestroy	call site: 05669	/src/leptonica/src/recogbasic.c:476
0	0	None	58	158	fopenReadStream	call site: 00012	/src/leptonica/src/utils2.c:1881
0	0	None	45	129	genPathname	call site: 00014	/src/leptonica/src/utils2.c:3098

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

2184

Reachable functions

2201

Percentage of reachable functions covered

0.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/recog_basic_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	10
/src/leptonica/src/recogbasic.c	7
/src/leptonica/src/utils2.c	31
/src/leptonica/src/bmf.c	10
/src/leptonica/src/encoding.c	6
/src/leptonica/src/readfile.c	6
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	31
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	10
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	54
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	20
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/boxbasic.c	22
/src/leptonica/src/pixabasic.c	27
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	12
/src/leptonica/src/sel1.c	23
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/ptra.c	11
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/dnabasic.c	19
/src/leptonica/src/ptabasic.c	18
/src/leptonica/src/recogident.c	2
/src/leptonica/src/recogdid.c	1
/src/leptonica/src/recogtrain.c	3
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/strokes.c	1
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	3
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/writefile.c	6
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5

Fuzzer: boxfunc5_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8738	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.13%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	8752	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', 'boxaCreate', 'boxCreate', 'boxaDestroy', '__isoc99_fscanf', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1987

Reachable functions

1998

Percentage of reachable functions covered

0.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc5_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/boxbasic.c	26
/src/leptonica/src/utils2.c	27
/src/leptonica/src/boxfunc5.c	13
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/gplot.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	22
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	16
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numafunc1.c	15
/src/leptonica/src/ptra.c	10
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	2
/src/leptonica/src/writefile.c	4
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc2.c	2

Fuzzer: graymorph_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	496	71.9%
gold	[1:9]	3	0.43%
yellow	[10:29]	11	1.59%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	178	25.8%
All colors	689	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00331	/src/leptonica/src/pix2.c:2038
720	720	1 : View List ['pixErodeGray3v']	720	2362	pixErodeGray3	call site: 00646	/src/leptonica/src/graymorph.c:678
720	720	1 : View List ['pixDilateGray3v']	720	2362	pixDilateGray3	call site: 00626	/src/leptonica/src/graymorph.c:858
238	238	2 : View List ['rasteropGeneralLow', 'rasteropVAlignedLow']	238	238	rasteropLow	call site: 00261	/src/leptonica/src/roplow.c:566
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00238	/src/leptonica/src/pix2.c:1907
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00177	/src/leptonica/src/utils2.c:352
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00163	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

45

Reachable functions

119

Percentage of reachable functions covered

62.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/graymorph_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	16
/src/leptonica/src/pix2.c	12
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	3
/src/leptonica/src/graymorph.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/pixconv.c	11

Fuzzer: checkerboard_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6486	89.4%
gold	[1:9]	5	0.06%
yellow	[10:29]	5	0.06%
greenyellow	[30:49]	3	0.04%
lawngreen	50+	755	10.4%
All colors	7254	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
22533	25161	5 : View List ['selaDisplayInPix', 'pixDisplay', 'pixWrite', 'lept_mkdir', 'pixDestroy']	22533	25178	selaMakeThinSets	call site: 02227	/src/leptonica/src/ccthin.c:455
3876	3876	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5430	5588	pixScaleGeneral	call site: 00953	/src/leptonica/src/scale1.c:450
2120	3666	4 : View List ['pixInvert', 'pixSubtract', 'pixExtractBorderConnComps', 'pixDestroy']	2120	3726	pixThinConnectedBySet	call site: 07180	/src/leptonica/src/ccthin.c:295
1947	1987	3 : View List ['pixConvertTo8', 'pixThresholdToBinary', 'pixDestroy']	1947	1987	pixConvertTo1	call site: 01740	/src/leptonica/src/pixconv.c:2968
1923	1923	1 : View List ['pixScaleGrayLI']	3477	3635	pixScaleGeneral	call site: 00954	/src/leptonica/src/scale1.c:462
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1940	pixScaleColorLI	call site: 01367	/src/leptonica/src/scale1.c:605
1914	1914	1 : View List ['pixScaleColor2xLI']	1914	1914	pixScaleColorLI	call site: 01312	/src/leptonica/src/scale1.c:587
1914	1914	1 : View List ['pixScaleColor4xLI']	1914	1914	pixScaleColorLI	call site: 01313	/src/leptonica/src/scale1.c:589
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 07148	/src/leptonica/src/compare.c:267
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 00954	/src/leptonica/src/scale1.c:467
864	869	2 : View List ['pixRemoveColormap', 'lept_stderr']	864	927	pixConvertTo8Or32	call site: 00943	/src/leptonica/src/pixconv.c:3415
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 07150	/src/leptonica/src/compare.c:278

Runtime coverage analysis

Covered functions

237

Functions that are reachable but not covered

1333

Reachable functions

1568

Percentage of reachable functions covered

14.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/checkerboard_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	28
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	9
/src/leptonica/src/pixabasic.c	16
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/utils2.c	27
/src/leptonica/src/checkerboard.c	3
/src/leptonica/src/morph.c	8
/src/leptonica/src/sel1.c	24
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/rotateorth.c	1
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/pixafunc1.c	9
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	4
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/writefile.c	6
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/boxfunc2.c	1

Fuzzer: pix4_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9174	91.5%
gold	[1:9]	4	0.03%
yellow	[10:29]	10	0.09%
greenyellow	[30:49]	4	0.03%
lawngreen	50+	827	8.25%
All colors	10019	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
30243	32048	6 : View List ['pixaAddPix', 'gplotSimplePix1', 'numaCreate', 'lept_mkdir', 'numaAddNumber', 'extractRGBValues']	30243	32114	pixGetBinnedColor	call site: 06083	/src/leptonica/src/pix4.c:2763
24780	24825	4 : View List ['lept_stderr', 'pixDisplay', 'pixDestroy', 'pixDisplayColorArray']	24780	24833	pixGetBinnedComponentRange	call site: 09586	/src/leptonica/src/pix4.c:2477
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 01976	/src/leptonica/src/readfile.c:197
3576	4275	10 : View List ['pixaAddPix', 'pixReadStreamPng', 'pixaDestroy', 'pixSetXRes', 'pixSetYRes', 'boxaDestroy', 'boxaReadStream', 'pixaCreate', '__isoc99_fscanf', 'lept_stderr']	3576	4331	pixaReadStream	call site: 06757	/src/leptonica/src/pixabasic.c:2533
1169	1180	2 : View List ['pixGetAverageMaskedRGB', 'composeRGBPixel']	1169	1226	pixGetPixelStats	call site: 00788	/src/leptonica/src/pix4.c:1348
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 06456	/src/leptonica/src/pix2.c:2038
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	2008	pixGetAverageTiledRGB	call site: 00926	/src/leptonica/src/pix4.c:1654
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00850	/src/leptonica/src/pix2.c:2488
764	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	764	1163	pixRemoveColormap	call site: 00218	/src/leptonica/src/pixconv.c:385
728	728	1 : View List ['pixInvert']	728	1512	pixSetMasked	call site: 09813	/src/leptonica/src/pix3.c:200
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00136	/src/leptonica/src/pixconv.c:3071
238	238	2 : View List ['rasteropGeneralLow', 'rasteropVAlignedLow']	238	238	rasteropLow	call site: 00320	/src/leptonica/src/roplow.c:566

Runtime coverage analysis

Covered functions

246

Functions that are reachable but not covered

1958

Reachable functions

2205

Percentage of reachable functions covered

11.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix4_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	28
/src/leptonica/src/pix4.c	28
/src/leptonica/src/pix3.c	9
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/boxbasic.c	22
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/pixabasic.c	20
/src/leptonica/src/map.c	5
/src/leptonica/src/rbtree.c	22
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/numafunc1.c	9
/src/leptonica/src/scale1.c	30
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/colorspace.c	2
/src/leptonica/src/dnabasic.c	21
/src/leptonica/src/numafunc2.c	6
/src/leptonica/src/gplot.c	10
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/readfile.c	6
/src/leptonica/src/tiffio.c	20
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	54
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	6
/src/leptonica/src/pix5.c	2
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/ptra.c	10
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/writefile.c	7
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/boxfunc3.c	1

Fuzzer: edge_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5391	97.8%
gold	[1:9]	4	0.07%
yellow	[10:29]	9	0.16%
greenyellow	[30:49]	5	0.09%
lawngreen	50+	102	1.85%
All colors	5511	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11620	11692	8 : View List ['pixSetPixel', 'pixGetColormap', 'pixWrite', 'pixcmapAddColor', 'pixDestroy', 'pixConvertTo8', 'numaGetIValue', 'pixcmapGetCount']	11620	11692	pixGetEdgeProfile	call site: 00212	/src/leptonica/src/edge.c:465
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	22	1 : View List ['numaCreate']	0	246	numaFindExtrema	call site: 05495	/src/leptonica/src/numafunc2.c:2508
0	19	2 : View List ['numaDestroy', 'returnErrorPtr']	0	19	numaCreate	call site: 00147	/src/leptonica/src/numabasic.c:201
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorInt']	0	7	pixMeasureEdgeSmoothness	call site: 00140	/src/leptonica/src/edge.c:335
0	7	1 : View List ['returnErrorInt']	0	7	pixGetLastOnPixelInRun	call site: 00186	/src/leptonica/src/edge.c:598
0	7	1 : View List ['returnErrorInt']	0	7	numaAddNumber	call site: 00171	/src/leptonica/src/numabasic.c:470
0	7	1 : View List ['returnErrorInt']	0	7	numaGetFValue	call site: 05499	/src/leptonica/src/numabasic.c:697
0	7	1 : View List ['returnErrorInt']	0	7	numaGetIValue	call site: 00537	/src/leptonica/src/numabasic.c:732
0	7	1 : View List ['returnErrorInt']	0	7	numaExtendArray	call site: 00175	/src/leptonica/src/numabasic.c:504

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

1266

Reachable functions

1321

Percentage of reachable functions covered

4.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/edge_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	13
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	14
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/edge.c	4
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/utils2.c	23
/src/leptonica/src/pixconv.c	15
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/writefile.c	4
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/bytearray.c	7
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc2.c	1

Fuzzer: pix_orient_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6941	95.0%
gold	[1:9]	9	0.12%
yellow	[10:29]	22	0.30%
greenyellow	[30:49]	3	0.04%
lawngreen	50+	324	4.43%
All colors	7299	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13884	14596	9 : View List ['pixMorphSequence', 'boxaGetBox', 'pixConnComp', 'boxaGetCount', 'boxGetGeometry', 'boxDestroy', 'boxaDestroy', 'pixRasterop', 'pixCreateTemplate']	25812	58007	pixUpDownDetect	call site: 00312	/src/leptonica/src/flipdetect.c:608
11722	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11722	11736	pixMorphCompSequence	call site: 06589	/src/leptonica/src/morphseq.c:409
10458	10473	2 : View List ['pixWriteDebug', 'lept_stderr']	10458	10601	pixUpDownDetect	call site: 07230	/src/leptonica/src/flipdetect.c:664
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00602	/src/leptonica/src/pix2.c:2038
938	938	1 : View List ['pixCloseCompBrick']	938	938	pixCloseSafeCompBrick	call site: 00981	/src/leptonica/src/morph.c:1667
734	734	1 : View List ['pixAnd']	11194	24641	pixUpDownDetect	call site: 07223	/src/leptonica/src/flipdetect.c:647
280	280	1 : View List ['lept_mkdir']	26092	71292	pixUpDownDetect	call site: 00139	/src/leptonica/src/flipdetect.c:590
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00540	/src/leptonica/src/roplow.c:569
75	75	1 : View List ['pixaCreate']	30064	34224	pixMorphCompSequence	call site: 00343	/src/leptonica/src/morphseq.c:332
54	1221	2 : View List ['pixRemoveBorder', 'pixSwapAndDestroy']	11776	12957	pixMorphCompSequence	call site: 06588	/src/leptonica/src/morphseq.c:404
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00515	/src/leptonica/src/pix2.c:1907
32	39	2 : View List ['sarrayExtendArray', 'returnErrorInt']	32	67	sarrayAddString	call site: 00173	/src/leptonica/src/sarray1.c:449

Runtime coverage analysis

Covered functions

127

Functions that are reachable but not covered

1439

Reachable functions

1564

Percentage of reachable functions covered

7.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix_orient_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/flipdetect.c	4
/src/leptonica/src/utils2.c	30
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/sel1.c	10
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/morph.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	17
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/rotateorth.c	8

Fuzzer: ccthin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7553	98.8%
gold	[1:9]	3	0.03%
yellow	[10:29]	7	0.09%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	80	1.04%
All colors	7644	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4150	4275	10 : View List ['pixaAddPix', 'pixReadStreamPng', 'pixaDestroy', 'pixSetXRes', 'pixSetYRes', 'boxaDestroy', 'boxaReadStream', 'pixaCreate', '__isoc99_fscanf', 'lept_stderr']	4150	4331	pixaReadStream	call site: 00142	/src/leptonica/src/pixabasic.c:2533
18	58	3 : View List ['free', 'boxaDestroy', 'pixDestroy']	18	58	pixaDestroy	call site: 00213	/src/leptonica/src/pixabasic.c:414
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	7	1 : View List ['returnErrorPtr']	0	7	pixaReadMem	call site: 00135	/src/leptonica/src/pixabasic.c:2588

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1635

Reachable functions

1680

Percentage of reachable functions covered

2.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/ccthin_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	7
/src/leptonica/src/pixabasic.c	12
/src/leptonica/src/utils2.c	28
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel1.c	22
/src/leptonica/src/sel2.c	3
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/writefile.c	6
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/morph.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3

Fuzzer: compare_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8362	94.7%
gold	[1:9]	3	0.03%
yellow	[10:29]	6	0.06%
greenyellow	[30:49]	16	0.18%
lawngreen	50+	436	4.94%
All colors	8823	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3938	3938	1 : View List ['pixScaleByIntSampling']	3938	85394	pixGetPerceptualDiff	call site: 00463	/src/leptonica/src/compare.c:1741
3348	3348	2 : View List ['pixAbsDifference', 'pixGetAverageMasked']	3348	3828	pixCompareRGB	call site: 08665	/src/leptonica/src/compare.c:1175
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01134	/src/leptonica/src/pix2.c:2038
1116	1116	2 : View List ['pixAbsDifference', 'pixGetAverageMasked']	1116	1196	pixCompareGray	call site: 08484	/src/leptonica/src/compare.c:1040
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00540	/src/leptonica/src/pix2.c:2488
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 08762	/src/leptonica/src/compare.c:278
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00226	/src/leptonica/src/pixconv.c:3071
209	350	4 : View List ['pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap', 'pixcmapAddColor']	209	350	pixConvert2To8	call site: 00359	/src/leptonica/src/pixconv.c:2468
170	311	4 : View List ['pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap', 'pixcmapAddColor']	170	311	pixConvert4To8	call site: 00391	/src/leptonica/src/pixconv.c:2571
161	538	2 : View List ['pixAddGrayColormap8', 'pixCopy']	161	538	pixConvertTo8	call site: 00397	/src/leptonica/src/pixconv.c:3083
161	161	1 : View List ['pixAddGrayColormap8']	161	201	pixConvertTo8	call site: 00435	/src/leptonica/src/pixconv.c:3098
161	161	1 : View List ['pixAddGrayColormap8']	161	161	pixConvertTo8	call site: 00409	/src/leptonica/src/pixconv.c:3092

Runtime coverage analysis

Covered functions

115

Functions that are reachable but not covered

1890

Reachable functions

2006

Percentage of reachable functions covered

5.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/compare_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	6
/src/leptonica/src/utils2.c	28
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/compare.c	8
/src/leptonica/src/scale1.c	30
/src/leptonica/src/scale2.c	22
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	6
/src/leptonica/src/graymorph.c	6
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/gplot.c	6
/src/leptonica/src/writefile.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	14
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/colormorph.c	1

Fuzzer: enhance_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5720	82.9%
gold	[1:9]	5	0.07%
yellow	[10:29]	216	3.13%
greenyellow	[30:49]	53	0.76%
lawngreen	50+	903	13.0%
All colors	6897	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3876	3876	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	3876	5588	pixScaleGeneral	call site: 06012	/src/leptonica/src/scale1.c:450
1923	1923	1 : View List ['pixScaleGrayLI']	1923	3635	pixScaleGeneral	call site: 06013	/src/leptonica/src/scale1.c:462
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1940	pixScaleColorLI	call site: 06289	/src/leptonica/src/scale1.c:605
1914	1914	1 : View List ['pixScaleColor2xLI']	1914	1914	pixScaleColorLI	call site: 06239	/src/leptonica/src/scale1.c:587
1914	1914	1 : View List ['pixScaleColor4xLI']	1914	1914	pixScaleColorLI	call site: 06240	/src/leptonica/src/scale1.c:589
1323	1323	1 : View List ['TIFFFlush']	1331	1466	TIFFCleanup	call site: 03453	/src/libtiff/libtiff/tif_close.c:49
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 05247	/src/leptonica/src/pix2.c:2038
1085	1125	3 : View List ['pixConvert16To8', 'pixConvert8To32', 'pixDestroy']	1085	1125	pixConvertTo32	call site: 06771	/src/leptonica/src/pixconv.c:3271
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00497	/src/leptonica/src/pix2.c:2488
907	907	1 : View List ['pixConvert2To8']	1783	1823	pixConvertTo32	call site: 06749	/src/leptonica/src/pixconv.c:3259
907	907	1 : View List ['pixConvert4To8']	1783	1823	pixConvertTo32	call site: 06767	/src/leptonica/src/pixconv.c:3264
886	886	1 : View List ['pixCloseBrick']	886	886	pixCloseSafeBrick	call site: 05112	/src/leptonica/src/morph.c:973

Runtime coverage analysis

Covered functions

382

Functions that are reachable but not covered

1029

Reachable functions

1395

Percentage of reachable functions covered

26.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/enhance_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	27
/src/leptonica/src/pix2.c	23
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	8
/src/leptonica/src/utils2.c	17
/src/leptonica/src/enhance.c	27
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/colorspace.c	2
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	4
/src/leptonica/src/readfile.c	5
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	3
/src/libpng/pngread.c	12
/src/libpng/png.c	52
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	12
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/ptra.c	9
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	22
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/kernel.c	5

Fuzzer: finditalic_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8197	85.8%
gold	[1:9]	4	0.04%
yellow	[10:29]	4	0.04%
greenyellow	[30:49]	5	0.05%
lawngreen	50+	1333	13.9%
All colors	9543	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
21821	23615	8 : View List ['pixaAddPix', 'pixDestroy', 'lept_mkdir', 'pixScaleToSize', 'numaGetCount', 'numaMakeSequence', 'gplotGeneralPix2', 'lept_stderr']	23593	25435	pixWordMaskByDilation	call site: 06898	/src/leptonica/src/jbclass.c:1517
10465	10465	1 : View List ['pixGenerateG4Data']	10465	10472	pixGenerateCIData	call site: 06113	/src/leptonica/src/pdfio2.c:1276
10464	10464	1 : View List ['pixWrite']	10464	10464	pixWriteDebug	call site: 09487	/src/leptonica/src/writefile.c:309
4418	9270	9 : View List ['pixConvertTo8Or32', 'pixGetSpp', 'pixGetRGBComponent', 'returnErrorPtr', 'pixCopyRGBComponent', 'pixDestroy', 'pixGetDepth', 'pixUnsharpMaskingGray', 'pixCreateRGBImage']	4418	9270	pixUnsharpMasking	call site: 01151	/src/leptonica/src/enhance.c:993
3846	3846	2 : View List ['pixScaleGrayLI', 'pixScaleColorLI']	3846	5558	pixScaleGeneral	call site: 01094	/src/leptonica/src/scale1.c:450
2397	2397	1 : View List ['pixGenerateJpegData']	2397	2404	pixGenerateCIData	call site: 05905	/src/leptonica/src/pdfio2.c:1270
1952	4558	19 : View List ['pixGetSpp', 'pixScaleAndTransferAlpha', 'pixDestroy', 'pixConvertTo8', 'pixGetDepth', 'scaleGrayAreaMapLow', 'pixGetDimensions', 'pixCopyResolution', 'lept_stderr', 'pixGetWpl', 'pixGetData', 'returnErrorPtr', 'pixScaleResolution', 'pixClone', 'pixCopyInputFormat', 'pixGetColormap', 'pixRemoveColormap', 'scaleColorAreaMapLow', 'pixCreate']	1952	21865	pixScaleAreaMap	call site: 01146	/src/leptonica/src/scale1.c:1938
1933	1933	1 : View List ['pixScaleSmooth']	1933	3645	pixScaleGeneral	call site: 01094	/src/leptonica/src/scale1.c:451
1933	1933	1 : View List ['pixScaleSmooth']	1933	1938	pixScaleAreaMap	call site: 01102	/src/leptonica/src/scale1.c:1926
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1958	pixScaleAreaMap2	call site: 01470	/src/leptonica/src/scale1.c:2077
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00674	/src/leptonica/src/pix2.c:2038
1131	1189	5 : View List ['returnErrorPtr', 'pixSetInRectArbitrary', 'pixGetColormap', 'pixcmapAddBlackOrWhite', 'pixDestroy']	1131	1248	pixSetBlackOrWhiteBoxa	call site: 09277	/src/leptonica/src/boxfunc3.c:299

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

1773

Reachable functions

2148

Percentage of reachable functions covered

17.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/finditalic_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	33
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	7
/src/leptonica/src/finditalic.c	1
/src/leptonica/src/sel1.c	9
/src/leptonica/src/utils2.c	31
/src/leptonica/src/morph.c	12
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/boxfunc3.c	2
/src/leptonica/src/boxbasic.c	20
/src/leptonica/src/jbclass.c	1
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	27
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	21
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	29
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/numafunc1.c	3
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/gplot.c	8
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/graphics.c	7
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/morphapp.c	1

Fuzzer: morph_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4834	95.2%
gold	[1:9]	3	0.05%
yellow	[10:29]	5	0.09%
greenyellow	[30:49]	3	0.05%
lawngreen	50+	229	4.51%
All colors	5074	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00135	/src/leptonica/src/readfile.c:197
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04679	/src/leptonica/src/pix2.c:2038
238	238	2 : View List ['rasteropGeneralLow', 'rasteropVAlignedLow']	238	238	rasteropLow	call site: 02160	/src/leptonica/src/roplow.c:566
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 04651	/src/leptonica/src/pix2.c:1907
31	141	10 : View List ['pixGetWpl', 'pixdata_malloc', 'returnErrorInt', 'pixSetWidth', 'pixSetWpl', 'pixFreeAndSetData', 'pixSetHeight', 'pixGetDimensions', 'pixSetDepth', 'pixCopyResolution']	31	141	pixResizeImageData	call site: 02072	/src/leptonica/src/pix1.c:762
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00160	/src/leptonica/src/utils2.c:3163
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04913	/src/leptonica/src/pix2.c:1792
11	11	1 : View List ['pixClone']	11	11	pixRemoveBorder	call site: 05064	/src/leptonica/src/pix2.c:1996
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	getMorphBorderPixelColor	call site: 04910	/src/leptonica/src/morph.c:1766
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 02046	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

1140

Reachable functions

1241

Percentage of reachable functions covered

8.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/morph_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	20
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	4
/src/leptonica/src/readfile.c	4
/src/leptonica/src/utils2.c	13
/src/leptonica/src/tiffio.c	7
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/boxbasic.c	5
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/sel1.c	9
/src/leptonica/src/morph.c	10
/src/leptonica/src/fmorphgen.1.c	2
/src/leptonica/src/fmorphgenlow.1.c	117

Fuzzer: bilinear_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4747	95.8%
gold	[1:9]	5	0.10%
yellow	[10:29]	5	0.10%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	197	3.97%
All colors	4954	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00710	/src/leptonica/src/readfile.c:197
2547	4368	9 : View List ['pixClone', 'pixRemoveColormap', 'pixDestroy', 'pixConvertTo8', 'pixBilinearPtaColor', 'pixGetDepth', 'pixBilinearSampledPta', 'pixBilinearPtaGray', 'ptaGetCount']	2547	4375	pixBilinearPta	call site: 00235	/src/leptonica/src/bilinear.c:301
1233	1244	4 : View List ['free', 'getBilinearXformCoeffs', 'pixBilinearColor', 'ptaGetCount']	1233	1251	pixBilinearPtaColor	call site: 00634	/src/leptonica/src/bilinear.c:422
446	457	4 : View List ['free', 'pixBilinearGray', 'getBilinearXformCoeffs', 'ptaGetCount']	446	464	pixBilinearPtaGray	call site: 00612	/src/leptonica/src/bilinear.c:521
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00432	/src/leptonica/src/roplow.c:569
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00729	/src/leptonica/src/utils2.c:3163
24	24	1 : View List ['pixSetAll']	24	1500	pixBilinearPtaWithAlpha	call site: 04910	/src/leptonica/src/bilinear.c:673
11	11	1 : View List ['pixcmapGetCount']	11	60	pixSetAllArbitrary	call site: 00358	/src/leptonica/src/pix2.c:942
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04882	/src/leptonica/src/pix2.c:1792
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00713	/src/leptonica/src/utils2.c:3102
0	48	1 : View List ['pixSetAllArbitrary']	0	420	pixAddBorderGeneral	call site: 04889	/src/leptonica/src/pix2.c:1907
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355

Runtime coverage analysis

Covered functions

88

Functions that are reachable but not covered

1036

Reachable functions

1125

Percentage of reachable functions covered

7.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/bilinear_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	15
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/utils2.c	13
/src/leptonica/src/bilinear.c	11
/src/leptonica/src/affine.c	3
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	7
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pix5.c	1

Fuzzer: pageseg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6564	71.4%
gold	[1:9]	12	0.13%
yellow	[10:29]	29	0.31%
greenyellow	[30:49]	29	0.31%
lawngreen	50+	2548	27.7%
All colors	9182	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13602	13602	2 : View List ['pixApplyInvBackgroundRGBMap', 'pixGetBackgroundRGBMap']	13602	18528	pixBackgroundNorm	call site: 00514	/src/leptonica/src/adaptmap.c:375
11895	12082	12 : View List ['pixConvertTo8Or32', 'returnErrorPtr', 'pixClone', 'pixCopyInputFormat', 'pixScaleSmooth', 'pixDestroy', 'pixScaleColorLI', 'pixUnsharpMasking', 'pixGetDepth', 'pixScaleGrayLI', 'pixScaleAreaMap', 'pixCopyText']	11895	12082	pixScaleGeneral	call site: 01046	/src/leptonica/src/scale1.c:439
11333	11333	3 : View List ['pixRenderBoxArb', 'pixConvert1To4Cmap', 'pixacompAddPix']	11333	11584	pixFindPageForeground	call site: 08674	/src/leptonica/src/pageseg.c:1129
3508	3548	3 : View List ['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']	3508	3578	pixGetBackgroundGrayMap	call site: 06818	/src/leptonica/src/adaptmap.c:1018
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 07128	/src/leptonica/src/convolve.c:167
2397	2397	1 : View List ['pixGenerateJpegData']	2397	2404	pixGenerateCIData	call site: 05895	/src/leptonica/src/pdfio2.c:1270
1918	2341	11 : View List ['pixGetWpl', 'pixGetSpp', 'pixGetData', 'returnErrorPtr', 'pixScaleResolution', 'pixCopyInputFormat', 'pixCopyColormap', 'pixScaleAndTransferAlpha', 'pixCreate', 'pixCopyResolution', 'lept_stderr']	1918	2341	pixExpandReplicate	call site: 00987	/src/leptonica/src/scale2.c:872
1513	1513	2 : View List ['pixRotateAMColor', 'pixRotateAMGray']	1513	1633	pixRotate	call site: 07633	/src/leptonica/src/rotate.c:175
1504	1504	1 : View List ['pixRotate3Shear']	1504	1504	pixRotateShear	call site: 07635	/src/leptonica/src/rotateshear.c:227
1187	1187	1 : View List ['pixAlphaBlendUniform']	1189	2051	pixGenerateFlateData	call site: 06218	/src/leptonica/src/pdfio2.c:1378
1149	2729	4 : View List ['pixRotate2Shear', 'pixDestroy', 'pixGetRGBComponent', 'pixSetRGBComponent']	1149	2729	pixRotate2Shear	call site: 07674	/src/leptonica/src/rotateshear.c:291
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00869	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

689

Functions that are reachable but not covered

1156

Reachable functions

1816

Percentage of reachable functions covered

36.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pageseg_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	30
/src/leptonica/src/pix2.c	31
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	11
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/boxbasic.c	33
/src/leptonica/src/pageseg.c	9
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	8
/src/leptonica/src/utils2.c	31
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/adaptmap.c	10
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/morph.c	18
/src/leptonica/src/sel1.c	9
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/numabasic.c	24
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	6
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	5
/src/libpng/pngwrite.c	14
/src/libpng/png.c	19
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	3
/src/leptonica/src/psio2.c	6
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	20
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	15
/src/leptonica/src/stack.c	6
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/seedfill.c	4
/src/leptonica/src/compare.c	5
/src/leptonica/src/skew.c	7
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/rotateorth.c	1
/src/leptonica/src/pixafunc1.c	4
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/morphapp.c	2
/src/leptonica/src/ccbord.c	6
/src/leptonica/src/ptafunc1.c	2
/src/leptonica/src/graphics.c	10
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/pixcomp.c	12
/src/leptonica/src/boxfunc2.c	9
/src/leptonica/src/numafunc2.c	1

Fuzzer: barcode_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6514	87.3%
gold	[1:9]	5	0.06%
yellow	[10:29]	28	0.37%
greenyellow	[30:49]	62	0.83%
lawngreen	50+	850	11.3%
All colors	7459	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1523	1523	1 : View List ['pixRotateShearCenter']	1523	1643	pixRotate	call site: 06779	/src/leptonica/src/rotate.c:173
1308	1308	1 : View List ['pixReduceRankBinaryCascade']	7422	16383	pixFindSkewSweepAndSearchScorePivot	call site: 06584	/src/leptonica/src/skew.c:714
1149	1149	1 : View List ['pixRotateAMColor']	1149	1269	pixRotate	call site: 06840	/src/leptonica/src/rotate.c:185
873	873	1 : View List ['pixExtractBarcodeWidths2']	873	880	pixReadBarcodeWidths	call site: 06991	/src/leptonica/src/readbarcode.c:356
694	1779	4 : View List ['pixVShear', 'pixGetColormap', 'pixVShearIP', 'pixDestroy']	694	2156	pixVShear	call site: 06596	/src/leptonica/src/shear.c:251
582	582	1 : View List ['pixRotateBySampling']	582	702	pixRotate	call site: 06780	/src/leptonica/src/rotate.c:175
470	470	1 : View List ['pixRotate180']	470	827	pixRotateOrth	call site: 06508	/src/leptonica/src/rotateorth.c:85
388	388	1 : View List ['boxaBinSort']	388	388	boxaSort	call site: 06878	/src/leptonica/src/boxfunc2.c:653
322	322	1 : View List ['pixcmapAddBlackOrWhite']	3576	6034	pixRotate	call site: 06763	/src/leptonica/src/rotate.c:153
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00144	/src/leptonica/src/pixconv.c:3071
209	350	4 : View List ['pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap', 'pixcmapAddColor']	209	350	pixConvert2To8	call site: 00364	/src/leptonica/src/pixconv.c:2468
170	311	4 : View List ['pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap', 'pixcmapAddColor']	170	311	pixConvert4To8	call site: 00396	/src/leptonica/src/pixconv.c:2571

Runtime coverage analysis

Covered functions

240

Functions that are reachable but not covered

1360

Reachable functions

1600

Percentage of reachable functions covered

15.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/barcode_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	42
/src/leptonica/src/colormap.c	25
/src/leptonica/src/pix2.c	25
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/readbarcode.c	19
/src/leptonica/src/bardecode.c	11
/src/leptonica/src/pixconv.c	17
/src/leptonica/src/utils2.c	29
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/edge.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morph.c	8
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	9
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/writefile.c	6
/src/leptonica/src/scale2.c	16
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	15
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	11
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	18
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	13
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/jdapimin.c	5
/src/libjpeg-turbo/jdmarker.c	2
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	10
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/rotateorth.c	8
/src/leptonica/src/skew.c	3
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/shear.c	7
/src/leptonica/src/numafunc1.c	10
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/gplot.c	6
/src/leptonica/src/numafunc2.c	6

Fuzzer: kernel_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	76	45.7%
gold	[1:9]	4	2.40%
yellow	[10:29]	7	4.21%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	79	47.5%
All colors	166	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	kernelSetElement	call site: 00161	/src/leptonica/src/kernel.c:248
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	2 : View List ['free', 'returnErrorPtr']	0	7	kernelCreate	call site: 00144	/src/leptonica/src/kernel.c:133
0	7	1 : View List ['returnErrorPtr']	0	7	create2dFloatArray	call site: 00145	/src/leptonica/src/kernel.c:489
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

3

Reachable functions

50

Percentage of reachable functions covered

94.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/kernel_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	22
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	2
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/kernel.c	6

Fuzzer: boxfunc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8499	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.14%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	8513	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', 'boxaCreate', 'boxCreate', 'boxaDestroy', '__isoc99_fscanf', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1968

Reachable functions

1979

Percentage of reachable functions covered

0.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/boxbasic.c	24
/src/leptonica/src/utils2.c	27
/src/leptonica/src/boxfunc5.c	6
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/numabasic.c	9
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/gplot.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	22
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	16
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numafunc1.c	10
/src/leptonica/src/ptra.c	10
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/writefile.c	4
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6

Fuzzer: blend_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5019	91.4%
gold	[1:9]	3	0.05%
yellow	[10:29]	5	0.09%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	460	8.38%
All colors	5488	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00135	/src/leptonica/src/readfile.c:197
513	513	2 : View List ['pixConvert1To8Cmap', 'pixConvert1To8']	513	513	pixConvertTo8	call site: 04546	/src/leptonica/src/pixconv.c:3070
438	3039	17 : View List ['pixSetPixel', 'pixGetHeight', 'composeRGBPixel', 'pixDestroy', 'pixConvertTo8', 'pixGetDepth', 'extractRGBValues', 'pixGetDimensions', 'lept_stderr', 'pixGetWpl', 'pixGetData', 'pixCopy', 'pixClone', 'pixRemoveColormap', 'pixGetColormap', 'pixGetWidth', 'pixGetPixel']	438	3060	pixBlendMask	call site: 04535	/src/leptonica/src/blend.c:281
207	207	1 : View List ['pixConvert1To32']	207	207	pixConvertTo32	call site: 04745	/src/leptonica/src/pixconv.c:3257
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 02161	/src/leptonica/src/roplow.c:569
79	83	2 : View List ['extractRGBValues', 'pixSetMaskedCmap']	79	83	pixSetMasked	call site: 05380	/src/leptonica/src/pix3.c:177
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00160	/src/leptonica/src/utils2.c:3163
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00138	/src/leptonica/src/utils2.c:3102
2	2	2 : View List ['free', 'calloc']	2	2	pixConvert2To8	call site: 04591	/src/leptonica/src/pixconv.c:2468
0	907	1 : View List ['pixConvert2To8']	0	907	pixConvertTo8	call site: 04575	/src/leptonica/src/pixconv.c:3075
0	907	1 : View List ['pixConvert4To8']	0	907	pixConvertTo8	call site: 04576	/src/leptonica/src/pixconv.c:3077
0	736	2 : View List ['boxGetGeometry', 'pixClipRectangle']	0	1206	pixMultiplyByColor	call site: 05321	/src/leptonica/src/blend.c:1942

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

1028

Reachable functions

1158

Percentage of reachable functions covered

11.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/blend_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	5
/src/leptonica/src/readfile.c	4
/src/leptonica/src/utils2.c	13
/src/leptonica/src/tiffio.c	7
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/blend.c	18
/src/leptonica/src/boxbasic.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/pixarith.c	1
/src/leptonica/src/enhance.c	3
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/numafunc2.c	1
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/paintcmap.c	1

Fuzzer: dewarp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9998	90.1%
gold	[1:9]	8	0.07%
yellow	[10:29]	18	0.16%
greenyellow	[30:49]	65	0.58%
lawngreen	50+	999	9.00%
All colors	11088	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
67942	68060	10 : View List ['convertFilesToPdf', 'pixDisplayPta', 'ptaTranspose', 'pixGetHeight', 'pixWriteDebug', 'applyQuadraticFit', 'pixDisplay', 'pixDestroy', 'pixRenderHorizEndPoints', 'lept_stderr']	67942	69234	dewarpFindHorizDisparity	call site: 10179	/src/leptonica/src/dewarp2.c:688
61840	62132	7 : View List ['convertFilesToPdf', 'pixWriteDebug', 'pixDisplay', 'dewarpPopulateFullRes', 'pixDestroy', 'fpixRenderContours', 'lept_stderr']	61840	62149	dewarpBuildPageModel	call site: 10018	/src/leptonica/src/dewarp2.c:250
27485	27504	4 : View List ['dewarpDebug', 'convertFilesToPdf', 'dewarpaGetDewarp', 'lept_stderr']	27485	27576	dewarpaApplyDisparity	call site: 10829	/src/leptonica/src/dewarp3.c:176
25837	25848	11 : View List ['srand', 'pixDisplayPtaaPattern', 'pixRenderMidYs', 'pixClone', 'pixWriteDebug', 'pixDisplay', 'pixConvertTo32', 'generatePtaFilledCircle', 'pixRotateOrth', 'pixGenerateFromPta', 'numaWriteDebug']	43317	44840	dewarpFindVertDisparity	call site: 07952	/src/leptonica/src/dewarp2.c:430
23428	23848	5 : View List ['pixDisplayPtaa', 'pixWriteDebug', 'pixDestroy', 'pixDisplayWithTitle', 'pixCreateTemplate']	23428	23968	dewarpGetTextlineCenters	call site: 07549	/src/leptonica/src/dewarp2.c:890
22245	22245	2 : View List ['pixDisplayWithTitle', 'pixWriteDebug']	49730	49821	dewarpaApplyDisparity	call site: 10822	/src/leptonica/src/dewarp3.c:165
17024	17029	3 : View List ['convertFilesToPdf', 'ptaaWriteDebug', 'lept_stderr']	17024	17300	dewarpFindVertDisparity	call site: 08086	/src/leptonica/src/dewarp2.c:512
13602	13602	2 : View List ['pixApplyInvBackgroundRGBMap', 'pixGetBackgroundRGBMap']	13602	18528	pixBackgroundNorm	call site: 00471	/src/leptonica/src/adaptmap.c:375
12970	13427	4 : View List ['pixDisplayWithTitle', 'pixDisplayPtaa', 'pixDestroy', 'pixCopy']	12970	13451	dewarpRemoveShortLines	call site: 07704	/src/leptonica/src/dewarp2.c:1002
12382	12382	3 : View List ['pixDisplayWithTitle', 'lept_rmdir', 'lept_mkdir']	110450	172914	dewarpBuildPageModel	call site: 07329	/src/leptonica/src/dewarp2.c:170
11662	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11662	11736	pixMorphSequence	call site: 06510	/src/leptonica/src/morphseq.c:243
3508	3548	3 : View List ['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']	3508	3578	pixGetBackgroundGrayMap	call site: 06798	/src/leptonica/src/adaptmap.c:1018

Runtime coverage analysis

Covered functions

310

Functions that are reachable but not covered

2029

Reachable functions

2338

Percentage of reachable functions covered

13.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/dewarp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	1
/src/leptonica/src/utils1.c	13
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	32
/src/leptonica/src/pix2.c	32
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	10
/src/leptonica/src/dewarp4.c	10
/src/leptonica/src/pixconv.c	23
/src/leptonica/src/utils2.c	32
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/grayquant.c	5
/src/leptonica/src/adaptmap.c	9
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	15
/src/leptonica/src/pixabasic.c	14
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	15
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/numabasic.c	28
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/leptonica/src/pngio.c	4
/src/libpng/pngwrite.c	14
/src/libpng/png.c	54
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/libpng/pngset.c	21
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	20
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	8
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	6
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	25
/src/leptonica/src/numafunc1.c	14
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/dewarp1.c	12
/src/leptonica/src/dewarp2.c	15
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixafunc1.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/ptafunc1.c	16
/src/leptonica/src/graphics.c	7
/src/leptonica/src/rotateorth.c	8
/src/leptonica/src/affine.c	1
/src/leptonica/src/ptafunc2.c	5
/src/leptonica/src/sarray2.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/leptonica/src/dewarp3.c	6
/src/leptonica/src/fpix2.c	5
/src/leptonica/src/pageseg.c	1
/src/leptonica/src/skew.c	6
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/gplot.c	8
/src/leptonica/src/numafunc2.c	2
/src/leptonica/src/pixcomp.c	14

Fuzzer: colorfill_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	50.0%
gold	[1:9]	34	15.4%
yellow	[10:29]	7	3.18%
greenyellow	[30:49]	1	0.45%
lawngreen	50+	68	30.9%
All colors	220	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
46	57	3 : View List ['returnErrorInt', 'boxDestroy', 'boxaExtendArray']	46	57	boxaAddBox	call site: 00164	/src/leptonica/src/boxbasic.c:577
45	45	2 : View List ['boxClone', 'boxCopy']	105	127	boxaAddBox	call site: 00156	/src/leptonica/src/boxbasic.c:565
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['returnErrorPtr', 'pixDestroy']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	25	2 : View List ['boxaDestroy', 'returnErrorPtr']	0	25	boxaCreate	call site: 00141	/src/leptonica/src/boxbasic.c:453
0	25	2 : View List ['returnErrorPtr', 'l_dnaaDestroy']	0	25	l_dnaaCreate	call site: 00195	/src/leptonica/src/dnabasic.c:1194
0	25	2 : View List ['returnErrorPtr', 'numaaDestroy']	0	25	numaaCreate	call site: 00187	/src/leptonica/src/numabasic.c:1314
0	7	1 : View List ['returnErrorPtr']	2	24	boxCreate	call site: 00149	/src/leptonica/src/boxbasic.c:186

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

10

Reachable functions

66

Percentage of reachable functions covered

84.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/colorfill_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/colorfill.c	2
/src/leptonica/src/boxbasic.c	11
/src/leptonica/src/utils2.c	1
/src/leptonica/src/numabasic.c	3
/src/leptonica/src/dnabasic.c	3
/src/leptonica/src/pixabasic.c	2

Fuzzer: grayquant_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	323	55.0%
gold	[1:9]	3	0.51%
yellow	[10:29]	6	1.02%
greenyellow	[30:49]	2	0.34%
lawngreen	50+	253	43.1%
All colors	587	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
764	1158	4 : View List ['pixInvert', 'pixDestroyColormap', 'pixcmapGetColor', 'pixCopy']	764	1163	pixRemoveColormap	call site: 00272	/src/leptonica/src/pixconv.c:385
137	137	2 : View List ['pixcmapResetColor', 'pixcmapGetRankIntensity']	137	137	pixcmapSetBlackAndWhite	call site: 00564	/src/leptonica/src/colormap.c:669
103	103	3 : View List ['pixcmapHasColor', 'pixcmapIsBlackAndWhite', 'pixcmapIsOpaque']	893	1772	pixRemoveColormap	call site: 00256	/src/leptonica/src/pixconv.c:367
69	69	1 : View List ['makeGrayQuantColormapArb']	75	1516	pixThresholdGrayArb	call site: 00500	/src/leptonica/src/grayquant.c:1758
40	40	2 : View List ['returnErrorInt', 'numaExtendArray']	40	40	numaAddNumber	call site: 00468	/src/leptonica/src/numabasic.c:469
22	35	3 : View List ['composeRGBPixel', 'composeRGBAPixel', 'pixSetSpp']	24	262	pixRemoveColormap	call site: 00303	/src/leptonica/src/pixconv.c:397
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddColor	call site: 00343	/src/leptonica/src/colormap.c:413
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	makeGrayQuantTableArb	call site: 00506	/src/leptonica/src/grayquant.c:1943
7	7	1 : View List ['returnErrorInt']	7	7	numaGetIValue	call site: 00511	/src/leptonica/src/numabasic.c:732
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00163	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

36

Reachable functions

127

Percentage of reachable functions covered

71.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/grayquant_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	41
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	4
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	5
/src/leptonica/src/grayquant.c	17
/src/leptonica/src/pixconv.c	1
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/kernel.c	1
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/numafunc1.c	2

Fuzzer: binarize_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8871	89.8%
gold	[1:9]	9	0.09%
yellow	[10:29]	31	0.31%
greenyellow	[30:49]	14	0.14%
lawngreen	50+	948	9.60%
All colors	9873	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13602	13602	2 : View List ['pixApplyInvBackgroundRGBMap', 'pixGetBackgroundRGBMap']	13602	18528	pixBackgroundNorm	call site: 04507	/src/leptonica/src/adaptmap.c:375
11662	11722	2 : View List ['pixaConvertToPdf', 'pixaDestroy']	11662	11736	pixMorphSequence	call site: 08447	/src/leptonica/src/morphseq.c:243
9830	10829	8 : View List ['gplotMakeOutputPix', 'gplotDestroy', 'gplotCreate', 'lept_mkdir', 'numaGetMax', 'numaReplaceNumber', 'gplotAddPlot', 'numaMakeConstant']	9830	10905	pixSplitDistributionFgBg	call site: 09537	/src/leptonica/src/pix4.c:3466
9570	9570	2 : View List ['pixReadStream', 'fclose']	9570	9577	pixRead	call site: 00135	/src/leptonica/src/readfile.c:197
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 09043	/src/leptonica/src/convolve.c:167
2384	2913	16 : View List ['pixCopySpp', 'pixGetSpp', 'pixCopyColormap', 'pixScaleAndTransferAlpha', 'pixGetDepth', 'pixGetDimensions', 'pixCopyResolution', 'pixGetWpl', 'pixGetData', 'returnErrorPtr', 'pixScaleResolution', 'pixCopyInputFormat', 'scaleBySamplingLow', 'pixCreate', 'pixCopyText', 'pixScaleBinaryWithShift']	2384	2913	pixScaleBySamplingWithShift	call site: 08754	/src/leptonica/src/scale1.c:1359
1936	1936	1 : View List ['pixScaleGeneral']	1936	1941	pixScaleSmooth	call site: 05193	/src/leptonica/src/scale1.c:1723
1918	1918	1 : View List ['pixScaleAndTransferAlpha']	1918	1958	pixScaleSmooth	call site: 05195	/src/leptonica/src/scale1.c:1767
1546	3548	3 : View List ['pixScaleBySampling', 'pixDestroy', 'pixSmoothConnectedRegions']	1546	3578	pixGetBackgroundGrayMap	call site: 08731	/src/leptonica/src/adaptmap.c:1018
1167	1221	2 : View List ['pixRemoveBorder', 'pixSwapAndDestroy']	12829	12957	pixMorphSequence	call site: 08446	/src/leptonica/src/morphseq.c:238
1167	1167	1 : View List ['pixRemoveBorder']	1167	3187	pixSauvolaBinarize	call site: 09619	/src/leptonica/src/binarize.c:633
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04836	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

275

Functions that are reachable but not covered

1877

Reachable functions

2151

Percentage of reachable functions covered

12.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/binarize_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	12
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	31
/src/leptonica/src/tiffio.c	15
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	11
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	112
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	4
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	18
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	53
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	21
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	2
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/binarize.c	9
/src/leptonica/src/adaptmap.c	10
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	14
/src/leptonica/src/convolve.c	8
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	23
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/jcapimin.c	5
/src/libjpeg-turbo/jdatadst.c	1
/src/libjpeg-turbo/jcparam.c	11
/src/libjpeg-turbo/jcapistd.c	2
/src/libjpeg-turbo/jcinit.c	1
/src/libjpeg-turbo/jcmaster.c	4
/src/libjpeg-turbo/jccolor.c	3
/src/libjpeg-turbo/jcsample.c	3
/src/libjpeg-turbo/jcprepct.c	4
/src/libjpeg-turbo/jclossls.c	3
/src/libjpeg-turbo/jclhuff.c	1
/src/libjpeg-turbo/jcdiffct.c	3
/src/libjpeg-turbo/jcdctmgr.c	2
/src/libjpeg-turbo/jcarith.c	1
/src/libjpeg-turbo/jcphuff.c	1
/src/libjpeg-turbo/jchuff.c	1
/src/libjpeg-turbo/jccoefct.c	2
/src/libjpeg-turbo/jcmainct.c	3
/src/libjpeg-turbo/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	50
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	2
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	21
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	5
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/utils/bit_writer_utils.c	15
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/enc/vp8l_enc.c	17
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	15
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/seedfill.c	6
/src/leptonica/src/graymorph.c	2
/src/leptonica/src/queue.c	6
/src/leptonica/src/pixtiling.c	7
/src/leptonica/src/numafunc2.c	6
/src/leptonica/src/gplot.c	9

Fuzzer: pix_rotate_shear_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3524	73.7%
gold	[1:9]	161	3.37%
yellow	[10:29]	127	2.65%
greenyellow	[30:49]	71	1.48%
lawngreen	50+	894	18.7%
All colors	4777	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
694	1779	4 : View List ['pixVShear', 'pixGetColormap', 'pixVShearIP', 'pixDestroy']	694	2156	pixVShear	call site: 04546	/src/leptonica/src/shear.c:251
684	1759	4 : View List ['pixHShearIP', 'pixGetColormap', 'pixDestroy', 'pixHShear']	684	2136	pixHShear	call site: 04425	/src/leptonica/src/shear.c:132
610	616	2 : View List ['VP8DecompressAlphaRows', 'VP8SetError']	610	616	FinishRow	call site: 03987	/src/libwebp/src/dec/frame_dec.c:454
363	363	1 : View List ['png_start_read_image']	363	1663	png_read_image	call site: 01376	/src/libpng/pngread.c:716
289	325	8 : View List ['png_reciprocal2', 'png_warning', 'png_gamma_correct', 'png_reciprocal', 'png_gamma_8bit_correct', 'png_gamma_significant', 'png_error', 'png_build_gamma_table']	289	325	png_init_read_transformations	call site: 01299	/src/libpng/pngrtran.c:1570
158	158	2 : View List ['InitYUVRescaler', 'InitRGBRescaler']	158	158	CustomSetup	call site: 00000	/src/libwebp/src/dec/io_dec.c:579
136	276	3 : View List ['png_colorspace_set_sRGB', 'png_chunk_benign_error', 'png_colorspace_sync']	136	276	png_handle_sRGB	call site: 01025	/src/libpng/pngrutil.c:1339
123	123	1 : View List ['pixcmapGetRankIntensity']	123	123	pixcmapAddBlackOrWhite	call site: 04534	/src/leptonica/src/colormap.c:635
119	119	1 : View List ['png_cache_unknown_chunk']	213	291	png_handle_unknown	call site: 00751	/src/libpng/pngrutil.c:3030
91	91	1 : View List ['png_do_compose']	269	302	png_do_read_transformations	call site: 01432	/src/libpng/pngrtran.c:4871
84	84	2 : View List ['png_do_expand', 'png_do_expand_palette']	409	470	png_do_read_transformations	call site: 01424	/src/libpng/pngrtran.c:4766
65	65	1 : View List ['EmitRescaledRowsRGBA']	65	65	ProcessRows	call site: 00000	/src/libwebp/src/dec/vp8l_dec.c:833

Runtime coverage analysis

Covered functions

549

Functions that are reachable but not covered

661

Reachable functions

1097

Percentage of reachable functions covered

39.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix_rotate_shear_fuzzer.cc	2
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	6
/src/leptonica/src/readfile.c	2
/src/leptonica/src/bmpio.c	1
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/utils2.c	5
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/jerror.c	1
/src/libjpeg-turbo/jdapimin.c	6
/src/libjpeg-turbo/jcomapi.c	3
/src/libjpeg-turbo/jmemmgr.c	1
/src/libjpeg-turbo/jmemnobs.c	3
/src/libjpeg-turbo/jdmarker.c	3
/src/libjpeg-turbo/jdinput.c	1
/src/libjpeg-turbo/jdatasrc.c	1
/src/libjpeg-turbo/jdmaster.c	6
/src/libjpeg-turbo/jutils.c	2
/src/libjpeg-turbo/jdapistd.c	3
/src/libjpeg-turbo/jquant1.c	8
/src/libjpeg-turbo/jquant2.c	3
/src/libjpeg-turbo/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/jdcolor.c	5
/src/libjpeg-turbo/jdsample.c	3
/src/libjpeg-turbo/jdpostct.c	3
/src/libjpeg-turbo/jdlossls.c	3
/src/libjpeg-turbo/jdlhuff.c	1
/src/libjpeg-turbo/jddiffct.c	3
/src/libjpeg-turbo/jddctmgr.c	2
/src/libjpeg-turbo/jdarith.c	1
/src/libjpeg-turbo/jdphuff.c	1
/src/libjpeg-turbo/jdhuff.c	1
/src/libjpeg-turbo/jstdhuff.c	2
/src/libjpeg-turbo/jdcoefct.c	2
/src/libjpeg-turbo/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	51
/src/libpng/pngmem.c	11
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	46
/src/zlib/crc32.c	5
/src/libpng/pngset.c	16
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngrtran.c	30
/src/libpng/pngtrans.c	15
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	8
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	10
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	111
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_getimage.c	4
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	1
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	15
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	46
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	2
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	3
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	2
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/leptonica/src/spixio.c	2
/src/leptonica/src/rotateshear.c	3
/src/leptonica/src/shear.c	5
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1