High level conclusions

Fuzzers reach 54.08% of cyclomatic complexity.

Fuzzers reach 48.74% of all functions.

Fuzzer adaptmap_fuzzer is blocked:

The runtime code coverage of adaptmap_fuzzer covers 8.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc5_fuzzer is blocked:

The runtime code coverage of boxfunc5_fuzzer covers 0.561% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer morphapp_fuzzer is blocked:

The runtime code coverage of morphapp_fuzzer covers 8.564% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer enhance_fuzzer is blocked:

The runtime code coverage of enhance_fuzzer covers 27.21% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer binarize_fuzzer is blocked:

The runtime code coverage of binarize_fuzzer covers 12.97% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer affine_fuzzer is blocked:

The runtime code coverage of affine_fuzzer covers 6.881% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pixconv_fuzzer is blocked:

The runtime code coverage of pixconv_fuzzer covers 8.419% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer colorquant_fuzzer is blocked:

The runtime code coverage of colorquant_fuzzer covers 24.47% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix3_fuzzer is blocked:

The runtime code coverage of pix3_fuzzer covers 6.397% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix_rotate_shear_fuzzer is blocked:

The runtime code coverage of pix_rotate_shear_fuzzer covers 28.43% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer mask_fuzzer is blocked:

The runtime code coverage of mask_fuzzer covers 12.67% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer edge_fuzzer is blocked:

The runtime code coverage of edge_fuzzer covers 4.157% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer dewarp_fuzzer is blocked:

The runtime code coverage of dewarp_fuzzer covers 13.44% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer checkerboard_fuzzer is blocked:

The runtime code coverage of checkerboard_fuzzer covers 14.96% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer barcode_fuzzer is blocked:

The runtime code coverage of barcode_fuzzer covers 14.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer compare_fuzzer is blocked:

The runtime code coverage of compare_fuzzer covers 5.897% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc3_fuzzer is blocked:

The runtime code coverage of boxfunc3_fuzzer covers 0.519% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer blend_fuzzer is blocked:

The runtime code coverage of blend_fuzzer covers 11.73% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer recog_basic_fuzzer is blocked:

The runtime code coverage of recog_basic_fuzzer covers 0.786% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer bilinear_fuzzer is blocked:

The runtime code coverage of bilinear_fuzzer covers 8.279% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer flipdetect_fuzzer is blocked:

The runtime code coverage of flipdetect_fuzzer covers 8.928% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pixa_recog_fuzzer is blocked:

The runtime code coverage of pixa_recog_fuzzer covers 28.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc_fuzzer is blocked:

The runtime code coverage of boxfunc_fuzzer covers 0.567% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer graphics_fuzzer is blocked:

The runtime code coverage of graphics_fuzzer covers 16.82% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer classapp_fuzzer is blocked:

The runtime code coverage of classapp_fuzzer covers 10.54% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer finditalic_fuzzer is blocked:

The runtime code coverage of finditalic_fuzzer covers 17.78% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix4_fuzzer is blocked:

The runtime code coverage of pix4_fuzzer covers 11.40% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer baseline_fuzzer is blocked:

The runtime code coverage of baseline_fuzzer covers 12.47% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer pix_orient_fuzzer is blocked:

The runtime code coverage of pix_orient_fuzzer covers 7.982% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer ccthin_fuzzer is blocked:

The runtime code coverage of ccthin_fuzzer covers 2.753% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer boxfunc4_fuzzer is blocked:

The runtime code coverage of boxfunc4_fuzzer covers 0.833% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer morph_fuzzer is blocked:

The runtime code coverage of morph_fuzzer covers 8.480% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3277 / 6723

Cyclomatic complexity statically reachable by fuzzers

36662 / 67783

Runtime code coverage of functions

2139 / 6723

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: bilateral_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1090	77.6%
gold	[1:9]	17	1.21%
yellow	[10:29]	18	1.28%
greenyellow	[30:49]	22	1.56%
lawngreen	50+	256	18.2%
All colors	1403	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00544	/src/leptonica/src/pix2.c:2488
318	318	1 : View List ['pixcmapGetRangeValues']	318	318	pixGetExtremeValue	call site: 01130	/src/leptonica/src/pix4.c:2189
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00328	/src/leptonica/src/roplow.c:569
58	98	3 : View List ['returnErrorInt', 'pixaExtendArray', 'pixDestroy']	58	98	pixaAddPix	call site: 01193	/src/leptonica/src/pixabasic.c:517
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 01116	/src/leptonica/src/pix2.c:1907
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00184	/src/leptonica/src/utils2.c:352
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	kernelSetElement	call site: 01312	/src/leptonica/src/kernel.c:248
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00170	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

109

Reachable functions

210

Percentage of reachable functions covered

48.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/bilateral_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	14
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	4
/src/leptonica/src/bilateral.c	9
/src/leptonica/src/scale1.c	26
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/pixabasic.c	10
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/kernel.c	11

Fuzzer: paintcmap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	53.8%
gold	[1:9]	6	2.08%
yellow	[10:29]	8	2.77%
greenyellow	[30:49]	2	0.69%
lawngreen	50+	117	40.6%
All colors	288	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00191	/src/leptonica/src/utils2.c:352
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	2	24	boxCreate	call site: 00136	/src/leptonica/src/boxbasic.c:186
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateTemplate	call site: 00147	/src/leptonica/src/pix1.c:387
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateTemplateNoInit	call site: 00150	/src/leptonica/src/pix1.c:421
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	7	1 : View List ['returnErrorPtr']	0	7	pixCopy	call site: 00145	/src/leptonica/src/pix1.c:705
0	7	1 : View List ['returnErrorInt']	0	7	pixCopyColormap	call site: 00177	/src/leptonica/src/pix1.c:819
0	7	1 : View List ['returnErrorInt']	0	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

9

Reachable functions

78

Percentage of reachable functions covered

88.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/paintcmap_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	43
/src/leptonica/src/colormap.c	9
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/utils2.c	3
/src/leptonica/src/paintcmap.c	2

Fuzzer: morph_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4784	94.9%
gold	[1:9]	3	0.05%
yellow	[10:29]	6	0.11%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	246	4.88%
All colors	5040	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00136	/src/leptonica/src/readfile.c:197
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04620	/src/leptonica/src/pix2.c:2038
238	238	2 : View List ['rasteropVAlignedLow', 'rasteropGeneralLow']	238	238	rasteropLow	call site: 02242	/src/leptonica/src/roplow.c:566
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 04590	/src/leptonica/src/pix2.c:1907
31	141	10 : View List ['pixGetDimensions', 'pixSetWidth', 'pixSetHeight', 'pixFreeAndSetData', 'pixGetWpl', 'pixCopyResolution', 'pixdata_malloc', 'pixSetDepth', 'returnErrorInt', 'pixSetWpl']	31	141	pixResizeImageData	call site: 02143	/src/leptonica/src/pix1.c:762
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00161	/src/leptonica/src/utils2.c:3165
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04869	/src/leptonica/src/pix2.c:1792
11	11	1 : View List ['pixClone']	11	11	pixRemoveBorder	call site: 05030	/src/leptonica/src/pix2.c:1996
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	getMorphBorderPixelColor	call site: 04866	/src/leptonica/src/morph.c:1766
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 02116	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

1090

Reachable functions

1191

Percentage of reachable functions covered

8.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/morph_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	20
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	4
/src/leptonica/src/readfile.c	4
/src/leptonica/src/utils2.c	13
/src/leptonica/src/tiffio.c	11
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/boxbasic.c	5
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/sel1.c	9
/src/leptonica/src/morph.c	10
/src/leptonica/src/fmorphgen.1.c	2
/src/leptonica/src/fmorphgenlow.1.c	117

Fuzzer: boxfunc4_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6841	99.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.17%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	6855	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', '__isoc99_fscanf', 'boxCreate', 'boxaCreate', 'boxaDestroy', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1309

Reachable functions

1320

Percentage of reachable functions covered

0.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc4_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/boxbasic.c	25
/src/leptonica/src/utils2.c	17
/src/leptonica/src/boxfunc4.c	11
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	4
/src/leptonica/src/readfile.c	5
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	8
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	3
/src/libpng/pngread.c	12
/src/libpng/png.c	30
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	22
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	3
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/ptra.c	9
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/graphics.c	6
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3

Fuzzer: ccthin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7817	98.8%
gold	[1:9]	3	0.03%
yellow	[10:29]	7	0.08%
greenyellow	[30:49]	2	0.02%
lawngreen	50+	80	1.01%
All colors	7909	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3463	3588	10 : View List ['pixaCreate', '__isoc99_fscanf', 'pixaAddPix', 'boxaDestroy', 'boxaReadStream', 'pixReadStreamPng', 'pixSetXRes', 'pixSetYRes', 'pixaDestroy', 'lept_stderr']	3463	3644	pixaReadStream	call site: 00143	/src/leptonica/src/pixabasic.c:2537
18	58	3 : View List ['free', 'boxaDestroy', 'pixDestroy']	18	58	pixaDestroy	call site: 00214	/src/leptonica/src/pixabasic.c:414
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	7	1 : View List ['returnErrorPtr']	0	7	pixaReadMem	call site: 00136	/src/leptonica/src/pixabasic.c:2592

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1589

Reachable functions

1634

Percentage of reachable functions covered

2.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/ccthin_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	7
/src/leptonica/src/pixabasic.c	12
/src/leptonica/src/utils2.c	28
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel1.c	23
/src/leptonica/src/sel2.c	3
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/writefile.c	6
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/morph.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3

Fuzzer: pix_orient_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7666	95.2%
gold	[1:9]	6	0.07%
yellow	[10:29]	29	0.36%
greenyellow	[30:49]	4	0.04%
lawngreen	50+	345	4.28%
All colors	8050	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13994	14706	9 : View List ['pixMorphSequence', 'boxaGetCount', 'boxGetGeometry', 'boxaGetBox', 'pixConnComp', 'boxaDestroy', 'pixCreateTemplate', 'pixRasterop', 'boxDestroy']	26032	58447	pixUpDownDetect	call site: 00315	/src/leptonica/src/flipdetect.c:613
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphCompSequence	call site: 07218	/src/leptonica/src/morphseq.c:409
10568	10583	2 : View List ['pixWriteDebug', 'lept_stderr']	10568	10711	pixUpDownDetect	call site: 07964	/src/leptonica/src/flipdetect.c:669
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00630	/src/leptonica/src/pix2.c:2038
938	938	1 : View List ['pixCloseCompBrick']	938	938	pixCloseSafeCompBrick	call site: 01028	/src/leptonica/src/morph.c:1667
734	734	1 : View List ['pixAnd']	11304	24861	pixUpDownDetect	call site: 07956	/src/leptonica/src/flipdetect.c:652
280	280	1 : View List ['lept_mkdir']	26312	71842	pixUpDownDetect	call site: 00140	/src/leptonica/src/flipdetect.c:595
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00567	/src/leptonica/src/roplow.c:569
54	1221	2 : View List ['pixSwapAndDestroy', 'pixRemoveBorder']	11886	13067	pixMorphCompSequence	call site: 07216	/src/leptonica/src/morphseq.c:404
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00537	/src/leptonica/src/pix2.c:1907
32	39	2 : View List ['returnErrorInt', 'sarrayExtendArray']	32	67	sarrayAddString	call site: 00175	/src/leptonica/src/sarray1.c:449
24	141	10 : View List ['pixGetDimensions', 'pixSetWidth', 'pixSetHeight', 'pixFreeAndSetData', 'pixGetWpl', 'pixCopyResolution', 'pixdata_malloc', 'pixSetDepth', 'returnErrorInt', 'pixSetWpl']	24	141	pixResizeImageData	call site: 00433	/src/leptonica/src/pix1.c:762

Runtime coverage analysis

Covered functions

127

Functions that are reachable but not covered

1441

Reachable functions

1566

Percentage of reachable functions covered

7.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix_orient_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/flipdetect.c	4
/src/leptonica/src/utils2.c	30
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/sel1.c	10
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/morph.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	17
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/rotateorth.c	8

Fuzzer: baseline_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9216	90.8%
gold	[1:9]	4	0.03%
yellow	[10:29]	8	0.07%
greenyellow	[30:49]	21	0.20%
lawngreen	50+	898	8.84%
All colors	10147	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11772	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11772	11846	pixMorphSequence	call site: 07566	/src/leptonica/src/morphseq.c:243
10564	10564	1 : View List ['pixWrite']	10564	10564	pixWriteDebug	call site: 10137	/src/leptonica/src/writefile.c:309
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 07888	/src/leptonica/src/readfile.c:197
4418	9270	9 : View List ['returnErrorPtr', 'pixGetSpp', 'pixUnsharpMaskingGray', 'pixGetRGBComponent', 'pixCopyRGBComponent', 'pixGetDepth', 'pixCreateRGBImage', 'pixConvertTo8Or32', 'pixDestroy']	4418	9270	pixUnsharpMasking	call site: 01741	/src/leptonica/src/enhance.c:993
3853	4186	18 : View List ['pixGetColormap', 'scaleGrayAreaMapLow', 'returnErrorPtr', 'pixCopyInputFormat', 'pixScaleAndTransferAlpha', 'pixRemoveColormap', 'pixGetData', 'pixScaleResolution', 'pixConvertTo8', 'pixGetDimensions', 'scaleColorAreaMapLow', 'pixClone', 'pixGetSpp', 'pixGetWpl', 'pixCopyResolution', 'pixGetDepth', 'pixCreate', 'lept_stderr']	3853	17848	pixScaleAreaMap	call site: 02078	/src/leptonica/src/scale1.c:1940
3812	3812	2 : View List ['pixScaleGrayLI', 'pixScaleColorLI']	3812	5524	pixScaleGeneral	call site: 01682	/src/leptonica/src/scale1.c:450
1906	1906	1 : View List ['pixScaleSmooth']	1906	3618	pixScaleGeneral	call site: 01682	/src/leptonica/src/scale1.c:451
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1946	pixScaleAreaMap2	call site: 02100	/src/leptonica/src/scale1.c:2077
1906	1906	1 : View List ['pixScaleSmooth']	1906	1911	pixScaleAreaMap	call site: 01690	/src/leptonica/src/scale1.c:1926
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01278	/src/leptonica/src/pix2.c:2038
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 01302	/src/leptonica/src/pix2.c:2488
1049	1049	1 : View List ['pixConvertTo8']	2955	3299	pixScaleAreaMap2	call site: 02085	/src/leptonica/src/scale1.c:2059

Runtime coverage analysis

Covered functions

259

Functions that are reachable but not covered

1817

Reachable functions

2076

Percentage of reachable functions covered

12.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/baseline_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	30
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/baseline.c	5
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/utils2.c	31
/src/leptonica/src/rop.c	2
/src/leptonica/src/roplow.c	10
/src/leptonica/src/skew.c	4
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/shear.c	5
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/ptafunc1.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/gplot.c	8
/src/leptonica/src/projective.c	4
/src/leptonica/src/affine.c	1
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/pixconv.c	17
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	12
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/libpng/pngrtran.c	32
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	5
/src/leptonica/src/graphics.c	5

Fuzzer: pix4_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9991	91.8%
gold	[1:9]	4	0.03%
yellow	[10:29]	10	0.09%
greenyellow	[30:49]	4	0.03%
lawngreen	50+	874	8.03%
All colors	10883	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
28515	30320	6 : View List ['lept_mkdir', 'pixaAddPix', 'numaAddNumber', 'extractRGBValues', 'numaCreate', 'gplotSimplePix1']	28515	30386	pixGetBinnedColor	call site: 06179	/src/leptonica/src/pix4.c:2763
24314	24359	4 : View List ['pixDestroy', 'pixDisplay', 'pixDisplayColorArray', 'lept_stderr']	24314	24367	pixGetBinnedComponentRange	call site: 10402	/src/leptonica/src/pix4.c:2477
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 02109	/src/leptonica/src/readfile.c:197
2889	3588	10 : View List ['pixaCreate', '__isoc99_fscanf', 'pixaAddPix', 'boxaDestroy', 'boxaReadStream', 'pixReadStreamPng', 'pixSetXRes', 'pixSetYRes', 'pixaDestroy', 'lept_stderr']	2889	3644	pixaReadStream	call site: 06973	/src/leptonica/src/pixabasic.c:2537
1169	1180	2 : View List ['composeRGBPixel', 'pixGetAverageMaskedRGB']	1169	1226	pixGetPixelStats	call site: 00825	/src/leptonica/src/pix4.c:1348
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 06626	/src/leptonica/src/pix2.c:2038
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	2008	pixGetAverageTiledRGB	call site: 00964	/src/leptonica/src/pix4.c:1654
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00888	/src/leptonica/src/pix2.c:2488
764	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	764	1163	pixRemoveColormap	call site: 00229	/src/leptonica/src/pixconv.c:385
728	728	1 : View List ['pixInvert']	728	1512	pixSetMasked	call site: 10663	/src/leptonica/src/pix3.c:200
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00137	/src/leptonica/src/pixconv.c:3071
238	238	2 : View List ['rasteropVAlignedLow', 'rasteropGeneralLow']	238	238	rasteropLow	call site: 00339	/src/leptonica/src/roplow.c:566

Runtime coverage analysis

Covered functions

246

Functions that are reachable but not covered

1919

Reachable functions

2166

Percentage of reachable functions covered

11.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix4_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	28
/src/leptonica/src/pix4.c	28
/src/leptonica/src/pix3.c	9
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/boxbasic.c	22
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/pixabasic.c	20
/src/leptonica/src/map.c	5
/src/leptonica/src/rbtree.c	22
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/numafunc1.c	9
/src/leptonica/src/scale1.c	30
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/colorspace.c	2
/src/leptonica/src/dnabasic.c	21
/src/leptonica/src/numafunc2.c	6
/src/leptonica/src/gplot.c	10
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/readfile.c	6
/src/leptonica/src/tiffio.c	30
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	33
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	6
/src/leptonica/src/pix5.c	2
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/ptra.c	10
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/writefile.c	7
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/boxfunc3.c	1

Fuzzer: finditalic_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8898	86.0%
gold	[1:9]	4	0.03%
yellow	[10:29]	4	0.03%
greenyellow	[30:49]	4	0.03%
lawngreen	50+	1433	13.8%
All colors	10343	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20669	22463	8 : View List ['gplotGeneralPix2', 'lept_mkdir', 'pixScaleToSize', 'pixaAddPix', 'numaGetCount', 'numaMakeSequence', 'pixDestroy', 'lept_stderr']	22441	24283	pixWordMaskByDilation	call site: 07582	/src/leptonica/src/jbclass.c:1517
10564	10564	1 : View List ['pixGenerateG4Data']	10564	10571	pixGenerateCIData	call site: 06683	/src/leptonica/src/pdfio2.c:1276
10564	10564	1 : View List ['pixWrite']	10564	10564	pixWriteDebug	call site: 10281	/src/leptonica/src/writefile.c:309
4418	9270	9 : View List ['returnErrorPtr', 'pixGetSpp', 'pixUnsharpMaskingGray', 'pixGetRGBComponent', 'pixCopyRGBComponent', 'pixGetDepth', 'pixCreateRGBImage', 'pixConvertTo8Or32', 'pixDestroy']	4418	9270	pixUnsharpMasking	call site: 01203	/src/leptonica/src/enhance.c:993
3812	3812	2 : View List ['pixScaleGrayLI', 'pixScaleColorLI']	3812	5524	pixScaleGeneral	call site: 01144	/src/leptonica/src/scale1.c:450
2455	2455	1 : View List ['pixGenerateJpegData']	2455	2462	pixGenerateCIData	call site: 06450	/src/leptonica/src/pdfio2.c:1270
1940	4546	19 : View List ['pixGetColormap', 'scaleGrayAreaMapLow', 'returnErrorPtr', 'pixCopyInputFormat', 'pixScaleAndTransferAlpha', 'pixRemoveColormap', 'pixGetData', 'pixScaleResolution', 'pixConvertTo8', 'pixDestroy', 'pixGetDimensions', 'scaleColorAreaMapLow', 'pixClone', 'pixGetSpp', 'pixGetWpl', 'pixCopyResolution', 'pixGetDepth', 'pixCreate', 'lept_stderr']	1940	21700	pixScaleAreaMap	call site: 01198	/src/leptonica/src/scale1.c:1938
1906	1906	1 : View List ['pixScaleSmooth']	1906	3618	pixScaleGeneral	call site: 01144	/src/leptonica/src/scale1.c:451
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1946	pixScaleAreaMap2	call site: 01563	/src/leptonica/src/scale1.c:2077
1906	1906	1 : View List ['pixScaleSmooth']	1906	1911	pixScaleAreaMap	call site: 01152	/src/leptonica/src/scale1.c:1926
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00704	/src/leptonica/src/pix2.c:2038
1131	1189	5 : View List ['pixSetInRectArbitrary', 'pixGetColormap', 'returnErrorPtr', 'pixcmapAddBlackOrWhite', 'pixDestroy']	1131	1248	pixSetBlackOrWhiteBoxa	call site: 10041	/src/leptonica/src/boxfunc3.c:299

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

1734

Reachable functions

2109

Percentage of reachable functions covered

17.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/finditalic_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pix2.c	33
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	7
/src/leptonica/src/finditalic.c	1
/src/leptonica/src/sel1.c	9
/src/leptonica/src/utils2.c	31
/src/leptonica/src/morph.c	12
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/boxfunc3.c	2
/src/leptonica/src/boxbasic.c	20
/src/leptonica/src/jbclass.c	1
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	27
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	12
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	29
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/numafunc1.c	3
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/gplot.c	8
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/libpng/pngrtran.c	32
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/graphics.c	7
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/morphapp.c	1

Fuzzer: classapp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9598	92.3%
gold	[1:9]	43	0.41%
yellow	[10:29]	7	0.06%
greenyellow	[30:49]	8	0.07%
lawngreen	50+	735	7.07%
All colors	10391	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
22272	22463	8 : View List ['gplotGeneralPix2', 'lept_mkdir', 'pixScaleToSize', 'pixaAddPix', 'numaGetCount', 'numaMakeSequence', 'pixDestroy', 'lept_stderr']	22272	24283	pixWordMaskByDilation	call site: 07563	/src/leptonica/src/jbclass.c:1517
12674	12939	9 : View List ['pixRenderBoxaArb', 'boxaaFlattenToBoxa', 'pixWrite', 'free', 'stringJoin', 'boxaDestroy', 'boxaAdjustSides', 'pixConvertTo32', 'pixDestroy']	12674	12939	pixFindWordAndCharacterBoxes	call site: 10361	/src/leptonica/src/classapp.c:620
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphSequence	call site: 07166	/src/leptonica/src/morphseq.c:243
11797	11984	12 : View List ['pixCopyText', 'pixUnsharpMasking', 'pixScaleGrayLI', 'pixClone', 'pixCopyInputFormat', 'pixScaleAreaMap', 'returnErrorPtr', 'pixScaleSmooth', 'pixGetDepth', 'pixConvertTo8Or32', 'pixScaleColorLI', 'pixDestroy']	11797	11984	pixScaleGeneral	call site: 00554	/src/leptonica/src/scale1.c:439
2400	2400	3 : View List ['pixRenderBoxaArb', 'pixUnpackBinary', 'pixaAddPix']	2400	2476	pixWordBoxesByDilation	call site: 09669	/src/leptonica/src/jbclass.c:1605
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01511	/src/leptonica/src/pix2.c:2038
764	1535	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	764	1535	pixConvertTo1	call site: 00515	/src/leptonica/src/pixconv.c:2968
764	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	764	1163	pixRemoveColormap	call site: 00370	/src/leptonica/src/pixconv.c:385
513	513	2 : View List ['pixConvert1To8', 'pixConvert1To8Cmap']	513	513	pixConvertTo8	call site: 00295	/src/leptonica/src/pixconv.c:3070
328	328	2 : View List ['lept_mkdir', 'stringReplaceSubstr']	25070	41165	pixFindWordAndCharacterBoxes	call site: 10295	/src/leptonica/src/classapp.c:563
209	350	4 : View List ['pixcmapAddColor', 'pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap']	209	350	pixConvert2To8	call site: 00414	/src/leptonica/src/pixconv.c:2468
209	209	1 : View List ['pixConvert16To8']	370	370	pixConvertTo8	call site: 00455	/src/leptonica/src/pixconv.c:3090

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

1891

Reachable functions

2114

Percentage of reachable functions covered

10.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/classapp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	4
/src/leptonica/src/boxbasic.c	30
/src/leptonica/src/utils2.c	33
/src/leptonica/src/classapp.c	2
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	21
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/scale1.c	28
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/jbclass.c	2
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	2
/src/libpng/pngwrite.c	14
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	12
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/gplot.c	8
/src/leptonica/src/rotateorth.c	6
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/libpng/pngrtran.c	32
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/boxfunc4.c	4
/src/leptonica/src/graphics.c	7
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/boxfunc2.c	9

Fuzzer: grayquant_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	335	55.2%
gold	[1:9]	3	0.49%
yellow	[10:29]	6	0.99%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	262	43.2%
All colors	606	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
764	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	764	1163	pixRemoveColormap	call site: 00284	/src/leptonica/src/pixconv.c:385
137	137	2 : View List ['pixcmapGetRankIntensity', 'pixcmapResetColor']	137	137	pixcmapSetBlackAndWhite	call site: 00583	/src/leptonica/src/colormap.c:669
103	103	3 : View List ['pixcmapIsBlackAndWhite', 'pixcmapIsOpaque', 'pixcmapHasColor']	893	1772	pixRemoveColormap	call site: 00268	/src/leptonica/src/pixconv.c:367
69	69	1 : View List ['makeGrayQuantColormapArb']	75	1516	pixThresholdGrayArb	call site: 00519	/src/leptonica/src/grayquant.c:1758
40	40	2 : View List ['numaExtendArray', 'returnErrorInt']	40	40	numaAddNumber	call site: 00486	/src/leptonica/src/numabasic.c:469
22	35	3 : View List ['composeRGBAPixel', 'composeRGBPixel', 'pixSetSpp']	24	262	pixRemoveColormap	call site: 00321	/src/leptonica/src/pixconv.c:397
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddColor	call site: 00361	/src/leptonica/src/colormap.c:413
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	makeGrayQuantTableArb	call site: 00525	/src/leptonica/src/grayquant.c:1943
7	7	1 : View List ['returnErrorInt']	7	7	numaGetIValue	call site: 00530	/src/leptonica/src/numabasic.c:732
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00170	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007

Runtime coverage analysis

Covered functions

89

Functions that are reachable but not covered

36

Reachable functions

127

Percentage of reachable functions covered

71.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/grayquant_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	4
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	5
/src/leptonica/src/grayquant.c	17
/src/leptonica/src/pixconv.c	1
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/kernel.c	1
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/numafunc1.c	2

Fuzzer: fpix2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	380	51.4%
gold	[1:9]	7	0.94%
yellow	[10:29]	5	0.67%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	346	46.8%
All colors	738	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1141	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	1141	1163	pixRemoveColormap	call site: 00174	/src/leptonica/src/pixconv.c:385
103	103	3 : View List ['pixcmapIsBlackAndWhite', 'pixcmapIsOpaque', 'pixcmapHasColor']	1270	1772	pixRemoveColormap	call site: 00158	/src/leptonica/src/pixconv.c:367
33	33	2 : View List ['fpixClone', 'ptaClone']	33	379	fpixProjectivePta	call site: 00693	/src/leptonica/src/fpix2.c:2084
33	33	2 : View List ['fpixClone', 'ptaClone']	33	377	fpixAffinePta	call site: 00553	/src/leptonica/src/fpix2.c:1969
22	35	3 : View List ['composeRGBAPixel', 'composeRGBPixel', 'pixSetSpp']	24	262	pixRemoveColormap	call site: 00307	/src/leptonica/src/pixconv.c:397
0	83	1 : View List ['fpixCopy']	0	83	fpixAddBorder	call site: 00519	/src/leptonica/src/fpix2.c:1369
0	83	1 : View List ['fpixCopy']	0	83	fpixRemoveBorder	call site: 00647	/src/leptonica/src/fpix2.c:1403
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	11	1 : View List ['pixClone']	0	11	pixRemoveColormap	call site: 00140	/src/leptonica/src/pixconv.c:338
0	10	1 : View List ['lept_stderr']	0	180	dpixConvertToPix	call site: 00438	/src/leptonica/src/fpix2.c:576
0	7	1 : View List ['returnErrorPtr']	0	47	pixConvertToDPix	call site: 00349	/src/leptonica/src/fpix2.c:247
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450

Runtime coverage analysis

Covered functions

112

Functions that are reachable but not covered

42

Reachable functions

156

Percentage of reachable functions covered

73.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/fpix2_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	12
/src/leptonica/src/pix2.c	3
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/fpix2.c	22
/src/leptonica/src/pixconv.c	3
/src/leptonica/src/utils2.c	4
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/fpix1.c	29
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/affine.c	3
/src/leptonica/src/projective.c	2

Fuzzer: graphics_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4934	88.9%
gold	[1:9]	3	0.05%
yellow	[10:29]	6	0.10%
greenyellow	[30:49]	12	0.21%
lawngreen	50+	592	10.6%
All colors	5547	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 01217	/src/leptonica/src/readfile.c:197
2925	3363	12 : View List ['pixGetDimensions', 'free', 'pixSeedfillBinary', 'pixOr', 'pixFindHorizontalRuns', 'pixCreateTemplate', 'calloc', 'pixInvert', 'pixSetPixel', 'pixDestroy', 'ptaPtInsidePolygon', 'lept_stderr']	2925	3370	pixFillPolygon	call site: 00145	/src/leptonica/src/graphics.c:2490
847	1745	11 : View List ['pixGetDimensions', 'ptaCropToMask', 'pixClipRectangle', 'boxCreate', 'lept_stderr', 'pixRenderPtaArb', 'ptaDestroy', 'pixRasterop', 'generatePtaHashBox', 'boxDestroy', 'pixDestroy']	847	1759	pixRenderHashMaskArb	call site: 05298	/src/leptonica/src/graphics.c:1973
728	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	728	1163	pixRemoveColormap	call site: 00433	/src/leptonica/src/pixconv.c:385
103	103	3 : View List ['pixcmapIsBlackAndWhite', 'pixcmapIsOpaque', 'pixcmapHasColor']	846	1772	pixRemoveColormap	call site: 00422	/src/leptonica/src/pixconv.c:367
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00299	/src/leptonica/src/roplow.c:569
60	60	1 : View List ['generatePtaFilledSquare']	60	802	makePlotPtaFromNumaGen	call site: 05401	/src/leptonica/src/graphics.c:1173
39	57	3 : View List ['returnErrorInt', 'boxaExtendArray', 'boxDestroy']	39	57	boxaAddBox	call site: 01075	/src/leptonica/src/boxbasic.c:577
34	45	2 : View List ['boxClone', 'boxCopy']	73	127	boxaAddBox	call site: 01070	/src/leptonica/src/boxbasic.c:565
34	34	1 : View List ['boxCopy']	34	34	boxaGetBox	call site: 00942	/src/leptonica/src/boxbasic.c:711
33	40	2 : View List ['numaExtendArray', 'returnErrorInt']	33	40	numaAddNumber	call site: 05363	/src/leptonica/src/numabasic.c:469
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 01236	/src/leptonica/src/utils2.c:3165

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

974

Reachable functions

1171

Percentage of reachable functions covered

16.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/graphics_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	8
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	12
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/graphics.c	32
/src/leptonica/src/runlength.c	1
/src/leptonica/src/ptafunc1.c	6
/src/leptonica/src/utils2.c	13
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixconv.c	15
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/morph.c	3
/src/leptonica/src/sel1.c	7
/src/leptonica/src/boxbasic.c	13
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	11
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/pix5.c	1
/src/leptonica/src/enhance.c	1
/src/leptonica/src/numafunc1.c	2

Fuzzer: graymorph_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	514	71.1%
gold	[1:9]	3	0.41%
yellow	[10:29]	11	1.52%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	193	26.7%
All colors	722	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00351	/src/leptonica/src/pix2.c:2038
720	720	1 : View List ['pixErodeGray3v']	720	2362	pixErodeGray3	call site: 00679	/src/leptonica/src/graymorph.c:678
720	720	1 : View List ['pixDilateGray3v']	720	2362	pixDilateGray3	call site: 00659	/src/leptonica/src/graymorph.c:858
238	238	2 : View List ['rasteropVAlignedLow', 'rasteropGeneralLow']	238	238	rasteropLow	call site: 00275	/src/leptonica/src/roplow.c:566
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00247	/src/leptonica/src/pix2.c:1907
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00184	/src/leptonica/src/utils2.c:352
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00170	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

45

Reachable functions

119

Percentage of reachable functions covered

62.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/graymorph_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	16
/src/leptonica/src/pix2.c	12
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/utils2.c	3
/src/leptonica/src/graymorph.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/pixconv.c	11

Fuzzer: boxfunc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9022	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.13%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	9036	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', '__isoc99_fscanf', 'boxCreate', 'boxaCreate', 'boxaDestroy', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1929

Reachable functions

1940

Percentage of reachable functions covered

0.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/boxbasic.c	24
/src/leptonica/src/utils2.c	27
/src/leptonica/src/boxfunc5.c	6
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/numabasic.c	9
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/gplot.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	22
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	16
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numafunc1.c	10
/src/leptonica/src/ptra.c	10
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/writefile.c	4
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6

Fuzzer: pixa_recog_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9990	80.3%
gold	[1:9]	37	0.29%
yellow	[10:29]	8	0.06%
greenyellow	[30:49]	18	0.14%
lawngreen	50+	2378	19.1%
All colors	12431	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11772	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11772	11846	pixMorphSequence	call site: 09753	/src/leptonica/src/morphseq.c:243
3821	4109	12 : View List ['pixGetDimensions', 'pixScaleColor4xLI', 'pixCopyInputFormat', 'returnErrorPtr', 'pixGetSpp', 'pixScaleAndTransferAlpha', 'pixGetData', 'scaleColorLILow', 'pixGetWpl', 'pixCopyResolution', 'pixScaleResolution', 'pixCreate']	3821	4109	pixScaleColorLI	call site: 06345	/src/leptonica/src/scale1.c:587
3812	3812	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5366	5524	pixScaleGeneral	call site: 06054	/src/leptonica/src/scale1.c:450
2952	7556	24 : View List ['pixaGetCount', 'pixGetXRes', 'pixaGetPixDimensions', 'pixaGetPix', 'pixaConvertToSameDepth', 'pixaDestroy', 'pixSetResolution', 'pixDestroy', 'pixaCreate', 'pixaGetDepthInfo', 'boxaAddBox', 'pixClone', 'free', 'pixaDisplay', 'pixSetText', 'boxaCreate', 'pixaAddPix', 'boxCreate', 'pixAddBorder', 'boxaWriteMem', 'pixaSetBoxa', 'pixScale', 'boxaGetExtent', 'lept_stderr']	2952	7563	pixaDisplayTiledInColumns	call site: 12009	/src/leptonica/src/pixafunc2.c:930
2588	25371	5 : View List ['pixWrite', 'lept_mkdir', 'selaDisplayInPix', 'pixDisplay', 'pixDestroy']	2588	25388	selaMakeThinSets	call site: 10661	/src/leptonica/src/ccthin.c:455
1906	1906	1 : View List ['pixScaleGrayLI']	3460	3618	pixScaleGeneral	call site: 06055	/src/leptonica/src/scale1.c:462
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1928	pixScaleColor2xLI	call site: 06359	/src/leptonica/src/scale1.c:648
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 06055	/src/leptonica/src/scale1.c:467
1442	1442	1 : View List ['TIFFFlush']	1450	1585	TIFFCleanup	call site: 02709	/src/libtiff/libtiff/tif_close.c:49
1392	3666	4 : View List ['pixExtractBorderConnComps', 'pixSubtract', 'pixInvert', 'pixDestroy']	1392	3726	pixThinConnectedBySet	call site: 10838	/src/leptonica/src/ccthin.c:295
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04921	/src/leptonica/src/pix2.c:2038
1085	1125	3 : View List ['pixConvert16To8', 'pixConvert8To32', 'pixDestroy']	1085	1125	pixConvertTo32	call site: 06646	/src/leptonica/src/pixconv.c:3271

Runtime coverage analysis

Covered functions

723

Functions that are reachable but not covered

1645

Reachable functions

2290

Percentage of reachable functions covered

28.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pixa_recog_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/pixabasic.c	33
/src/leptonica/src/utils2.c	31
/src/leptonica/src/boxbasic.c	34
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	28
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	33
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/pix2.c	34
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	14
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/recogbasic.c	9
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	6
/src/leptonica/src/readfile.c	6
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/tiffio.c	30
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numabasic.c	28
/src/leptonica/src/pix5.c	8
/src/leptonica/src/boxfunc1.c	7
/src/leptonica/src/morph.c	12
/src/leptonica/src/sel1.c	23
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	9
/src/leptonica/src/numafunc1.c	14
/src/leptonica/src/ptra.c	11
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/recogtrain.c	15
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	27
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	4
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	19
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/compare.c	5
/src/leptonica/src/recogident.c	14
/src/leptonica/src/recogdid.c	12
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/strokes.c	2
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	3
/src/leptonica/src/graphics.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc1.c	7
/src/leptonica/src/correlscore.c	1
/src/leptonica/src/textops.c	6
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/boxfunc4.c	1

Fuzzer: kernel_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	76	45.5%
gold	[1:9]	4	2.39%
yellow	[10:29]	7	4.19%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	80	47.9%
All colors	167	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	kernelSetElement	call site: 00162	/src/leptonica/src/kernel.c:248
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	2 : View List ['free', 'returnErrorPtr']	0	7	kernelCreate	call site: 00145	/src/leptonica/src/kernel.c:133
0	7	1 : View List ['returnErrorPtr']	0	7	create2dFloatArray	call site: 00146	/src/leptonica/src/kernel.c:489
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

3

Reachable functions

50

Percentage of reachable functions covered

94.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/kernel_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	22
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	2
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/kernel.c	6

Fuzzer: flipdetect_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7572	93.5%
gold	[1:9]	8	0.09%
yellow	[10:29]	32	0.39%
greenyellow	[30:49]	5	0.06%
lawngreen	50+	476	5.88%
All colors	8093	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphSequence	call site: 07760	/src/leptonica/src/morphseq.c:243
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphCompSequence	call site: 07213	/src/leptonica/src/morphseq.c:409
10564	10564	1 : View List ['pixWrite']	10564	10564	pixWriteDebug	call site: 07786	/src/leptonica/src/writefile.c:309
1253	14706	9 : View List ['pixMorphSequence', 'boxaGetCount', 'boxGetGeometry', 'boxaGetBox', 'pixConnComp', 'boxaDestroy', 'pixCreateTemplate', 'pixRasterop', 'boxDestroy']	1255	58447	pixUpDownDetect	call site: 07817	/src/leptonica/src/flipdetect.c:613
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00626	/src/leptonica/src/pix2.c:2038
938	938	1 : View List ['pixCloseCompBrick']	938	938	pixCloseSafeCompBrick	call site: 01024	/src/leptonica/src/morph.c:1667
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00563	/src/leptonica/src/roplow.c:569
75	75	1 : View List ['pixaCreate']	29841	33724	pixMorphSequence	call site: 07609	/src/leptonica/src/morphseq.c:166
75	75	1 : View List ['pixaCreate']	28590	34444	pixMorphCompSequence	call site: 00434	/src/leptonica/src/morphseq.c:332
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00533	/src/leptonica/src/pix2.c:1907
32	39	2 : View List ['returnErrorInt', 'sarrayExtendArray']	32	67	sarrayAddString	call site: 00263	/src/leptonica/src/sarray1.c:449
24	141	10 : View List ['pixGetDimensions', 'pixSetWidth', 'pixSetHeight', 'pixFreeAndSetData', 'pixGetWpl', 'pixCopyResolution', 'pixdata_malloc', 'pixSetDepth', 'returnErrorInt', 'pixSetWpl']	24	141	pixResizeImageData	call site: 00205	/src/leptonica/src/pix1.c:762

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

1428

Reachable functions

1568

Percentage of reachable functions covered

8.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/flipdetect_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	26
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/utils2.c	30
/src/leptonica/src/flipdetect.c	6
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/sel1.c	10
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	17
/src/leptonica/src/morph.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	17
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/rotateorth.c	8

Fuzzer: bilinear_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4698	95.4%
gold	[1:9]	4	0.08%
yellow	[10:29]	6	0.12%
greenyellow	[30:49]	4	0.08%
lawngreen	50+	209	4.24%
All colors	4921	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00740	/src/leptonica/src/readfile.c:197
2547	4368	9 : View List ['pixBilinearPtaGray', 'pixClone', 'pixBilinearSampledPta', 'ptaGetCount', 'pixBilinearPtaColor', 'pixRemoveColormap', 'pixGetDepth', 'pixConvertTo8', 'pixDestroy']	2547	4375	pixBilinearPta	call site: 00244	/src/leptonica/src/bilinear.c:301
1233	1244	4 : View List ['pixBilinearColor', 'free', 'ptaGetCount', 'getBilinearXformCoeffs']	1233	1251	pixBilinearPtaColor	call site: 00658	/src/leptonica/src/bilinear.c:422
446	457	4 : View List ['free', 'pixBilinearGray', 'ptaGetCount', 'getBilinearXformCoeffs']	446	464	pixBilinearPtaGray	call site: 00633	/src/leptonica/src/bilinear.c:521
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00450	/src/leptonica/src/roplow.c:569
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00759	/src/leptonica/src/utils2.c:3165
24	24	1 : View List ['pixSetAll']	24	1500	pixBilinearPtaWithAlpha	call site: 04876	/src/leptonica/src/bilinear.c:673
11	11	1 : View List ['pixcmapGetCount']	11	60	pixSetAllArbitrary	call site: 00368	/src/leptonica/src/pix2.c:942
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04841	/src/leptonica/src/pix2.c:1792
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00743	/src/leptonica/src/utils2.c:3104
0	48	1 : View List ['pixSetAllArbitrary']	0	420	pixAddBorderGeneral	call site: 04850	/src/leptonica/src/pix2.c:1907
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355

Runtime coverage analysis

Covered functions

88

Functions that are reachable but not covered

986

Reachable functions

1075

Percentage of reachable functions covered

8.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/bilinear_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	15
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/utils2.c	13
/src/leptonica/src/bilinear.c	11
/src/leptonica/src/affine.c	3
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	11
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pix5.c	1

Fuzzer: recog_basic_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10845	99.6%
gold	[1:9]	35	0.32%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.00%
All colors	10881	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
28996	29817	12 : View List ['recogDestroy', 'sarrayReadStream', 'pixaaDestroy', 'pixaaGetCount', 'pixaaReadStream', '__isoc99_fscanf', 'l_dnaReadStream', 'sarrayDestroy', 'recogAddAllSamples', 'recogCreate', 'l_dnaDestroy', 'lept_stderr']	28996	29915	recogReadStream	call site: 00066	/src/leptonica/src/recogbasic.c:859
944	944	14 : View List ['numaDestroy', 'pixaaDestroy', 'free', 'sarrayDestroy', 'rchaDestroy', 'recogDestroyDid', 'numaaDestroy', 'ptaaDestroy', 'rchDestroy', 'ptaDestroy', 'bmfDestroy', 'pixaDestroy', 'l_dnaDestroy', 'pixDestroy']	944	944	recogDestroy	call site: 05735	/src/leptonica/src/recogbasic.c:481
56	68	5 : View List ['splitPathAtDirectory', 'free', 'lept_stderr', 'fopen', 'returnErrorPtr1']	56	68	fopenReadStream	call site: 00050	/src/leptonica/src/utils2.c:1888
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00039	/src/leptonica/src/utils2.c:3165
7	7	1 : View List ['returnErrorInt']	7	7	convertSepCharsInPath	call site: 00029	/src/leptonica/src/utils2.c:3030
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00016	/src/leptonica/src/utils2.c:3104
0	7	1 : View List ['returnErrorPtr']	0	7	stringNew	call site: 00022	/src/leptonica/src/utils2.c:238
0	7	1 : View List ['returnErrorPtr']	0	7	genPathname	call site: 00034	/src/leptonica/src/utils2.c:3123
0	0	None	28998	29924	recogReadStream	call site: 00064	/src/leptonica/src/recogbasic.c:856
0	0	None	944	944	recogDestroy	call site: 05735	/src/leptonica/src/recogbasic.c:476
0	0	None	58	158	fopenReadStream	call site: 00013	/src/leptonica/src/utils2.c:1881
0	0	None	45	129	genPathname	call site: 00015	/src/leptonica/src/utils2.c:3100

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

2145

Reachable functions

2162

Percentage of reachable functions covered

0.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/recog_basic_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/recogbasic.c	7
/src/leptonica/src/utils2.c	31
/src/leptonica/src/bmf.c	10
/src/leptonica/src/encoding.c	6
/src/leptonica/src/readfile.c	6
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	31
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	10
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	4
/src/libpng/pngread.c	12
/src/libpng/png.c	33
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	30
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numabasic.c	23
/src/leptonica/src/boxbasic.c	22
/src/leptonica/src/pixabasic.c	27
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	12
/src/leptonica/src/sel1.c	23
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/ptra.c	11
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/dnabasic.c	19
/src/leptonica/src/ptabasic.c	18
/src/leptonica/src/recogident.c	2
/src/leptonica/src/recogdid.c	1
/src/leptonica/src/recogtrain.c	3
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/strokes.c	1
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	3
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/writefile.c	6
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5

Fuzzer: fhmtgen_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	502	65.4%
gold	[1:9]	3	0.39%
yellow	[10:29]	7	0.91%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	254	33.1%
All colors	767	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00465	/src/leptonica/src/pix2.c:2038
238	238	2 : View List ['rasteropVAlignedLow', 'rasteropGeneralLow']	238	238	rasteropLow	call site: 00407	/src/leptonica/src/roplow.c:566
58	58	1 : View List ['selCopy']	101	152	selaAddSel	call site: 00168	/src/leptonica/src/sel1.c:562
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00378	/src/leptonica/src/pix2.c:1907
36	48	3 : View List ['returnErrorInt', 'selDestroy', 'selaExtendArray']	36	48	selaAddSel	call site: 00179	/src/leptonica/src/sel1.c:572
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 00368	/src/leptonica/src/pix2.c:1792
11	11	1 : View List ['pixClone']	11	11	pixRemoveBorder	call site: 00450	/src/leptonica/src/pix2.c:1996
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixCopyColormap	call site: 00303	/src/leptonica/src/pix1.c:819
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059

Runtime coverage analysis

Covered functions

95

Functions that are reachable but not covered

47

Reachable functions

143

Percentage of reachable functions covered

67.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/fhmtgen_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	16
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/sel2.c	1
/src/leptonica/src/sel1.c	15
/src/leptonica/src/utils2.c	4
/src/leptonica/src/fhmtgen.1.c	2
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/fhmtgenlow.1.c	11
/src/leptonica/src/pixconv.c	11

Fuzzer: pageseg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7511	72.1%
gold	[1:9]	10	0.09%
yellow	[10:29]	25	0.24%
greenyellow	[30:49]	40	0.38%
lawngreen	50+	2819	27.0%
All colors	10405	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13712	13712	2 : View List ['pixGetBackgroundRGBMap', 'pixApplyInvBackgroundRGBMap']	13712	18638	pixBackgroundNorm	call site: 00538	/src/leptonica/src/adaptmap.c:375
11797	11984	12 : View List ['pixCopyText', 'pixUnsharpMasking', 'pixScaleGrayLI', 'pixClone', 'pixCopyInputFormat', 'pixScaleAreaMap', 'returnErrorPtr', 'pixScaleSmooth', 'pixGetDepth', 'pixConvertTo8Or32', 'pixScaleColorLI', 'pixDestroy']	11797	11984	pixScaleGeneral	call site: 01098	/src/leptonica/src/scale1.c:439
11443	11443	3 : View List ['pixacompAddPix', 'pixConvert1To4Cmap', 'pixRenderBoxArb']	11443	11694	pixFindPageForeground	call site: 09806	/src/leptonica/src/pageseg.c:1210
3508	3548	3 : View List ['pixSmoothConnectedRegions', 'pixScaleBySampling', 'pixDestroy']	3508	3578	pixGetBackgroundGrayMap	call site: 07517	/src/leptonica/src/adaptmap.c:1033
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 07869	/src/leptonica/src/convolve.c:167
2455	2455	1 : View List ['pixGenerateJpegData']	2455	2462	pixGenerateCIData	call site: 06442	/src/leptonica/src/pdfio2.c:1270
1906	2329	11 : View List ['returnErrorPtr', 'pixGetSpp', 'pixCopyColormap', 'pixScaleAndTransferAlpha', 'pixGetData', 'pixGetWpl', 'pixScaleResolution', 'pixCopyInputFormat', 'pixCopyResolution', 'pixCreate', 'lept_stderr']	1906	2329	pixExpandReplicate	call site: 01037	/src/leptonica/src/scale2.c:872
1513	1513	2 : View List ['pixRotateAMColor', 'pixRotateAMGray']	1513	1633	pixRotate	call site: 08522	/src/leptonica/src/rotate.c:175
1481	1481	1 : View List ['pixRotate3Shear']	1481	1481	pixRotateShear	call site: 08528	/src/leptonica/src/rotateshear.c:227
1187	1187	1 : View List ['pixAlphaBlendUniform']	1189	2051	pixGenerateFlateData	call site: 06816	/src/leptonica/src/pdfio2.c:1378
1149	2706	4 : View List ['pixRotate2Shear', 'pixGetRGBComponent', 'pixSetRGBComponent', 'pixDestroy']	1149	2706	pixRotate2Shear	call site: 08582	/src/leptonica/src/rotateshear.c:291
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00912	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

689

Functions that are reachable but not covered

1158

Reachable functions

1818

Percentage of reachable functions covered

36.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pageseg_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	49
/src/leptonica/src/colormap.c	30
/src/leptonica/src/pix2.c	31
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	11
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/boxbasic.c	33
/src/leptonica/src/pageseg.c	9
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	8
/src/leptonica/src/utils2.c	31
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/adaptmap.c	10
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/morph.c	18
/src/leptonica/src/sel1.c	9
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/numabasic.c	25
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	6
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	5
/src/libpng/pngwrite.c	14
/src/libpng/png.c	14
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	29
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	3
/src/leptonica/src/psio2.c	6
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	20
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	15
/src/leptonica/src/stack.c	6
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/seedfill.c	4
/src/leptonica/src/compare.c	5
/src/leptonica/src/skew.c	7
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/rotateorth.c	1
/src/leptonica/src/pixafunc1.c	4
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/morphapp.c	2
/src/leptonica/src/ccbord.c	6
/src/leptonica/src/ptafunc1.c	2
/src/leptonica/src/graphics.c	10
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/pixcomp.c	12
/src/leptonica/src/boxfunc2.c	9
/src/leptonica/src/numafunc2.c	1

Fuzzer: blend_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5033	90.8%
gold	[1:9]	2	0.03%
yellow	[10:29]	6	0.10%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	500	9.02%
All colors	5541	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00136	/src/leptonica/src/readfile.c:197
513	513	2 : View List ['pixConvert1To8', 'pixConvert1To8Cmap']	513	513	pixConvertTo8	call site: 04484	/src/leptonica/src/pixconv.c:3070
438	3039	17 : View List ['pixGetColormap', 'pixCopy', 'pixGetHeight', 'pixRemoveColormap', 'pixGetData', 'extractRGBValues', 'pixSetPixel', 'pixConvertTo8', 'pixGetPixel', 'pixDestroy', 'pixGetDimensions', 'pixClone', 'composeRGBPixel', 'pixGetDepth', 'pixGetWpl', 'pixGetWidth', 'lept_stderr']	438	3060	pixBlendMask	call site: 04471	/src/leptonica/src/blend.c:281
207	207	1 : View List ['pixConvert1To32']	207	207	pixConvertTo32	call site: 04704	/src/leptonica/src/pixconv.c:3257
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 02243	/src/leptonica/src/roplow.c:569
79	83	2 : View List ['extractRGBValues', 'pixSetMaskedCmap']	79	83	pixSetMasked	call site: 05414	/src/leptonica/src/pix3.c:177
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00161	/src/leptonica/src/utils2.c:3165
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00139	/src/leptonica/src/utils2.c:3104
2	2	2 : View List ['calloc', 'free']	2	2	pixConvert2To8	call site: 04531	/src/leptonica/src/pixconv.c:2468
0	907	1 : View List ['pixConvert2To8']	0	907	pixConvertTo8	call site: 04515	/src/leptonica/src/pixconv.c:3075
0	907	1 : View List ['pixConvert4To8']	0	907	pixConvertTo8	call site: 04516	/src/leptonica/src/pixconv.c:3077
0	736	2 : View List ['boxGetGeometry', 'pixClipRectangle']	0	1206	pixMultiplyByColor	call site: 05346	/src/leptonica/src/blend.c:1942

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

978

Reachable functions

1108

Percentage of reachable functions covered

11.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/blend_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	5
/src/leptonica/src/readfile.c	4
/src/leptonica/src/utils2.c	13
/src/leptonica/src/tiffio.c	11
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/blend.c	18
/src/leptonica/src/boxbasic.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/pixarith.c	1
/src/leptonica/src/enhance.c	3
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/numafunc2.c	1
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/paintcmap.c	1

Fuzzer: boxfunc3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10409	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.11%
greenyellow	[30:49]	1	0.00%
lawngreen	50+	1	0.00%
All colors	10423	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', '__isoc99_fscanf', 'boxCreate', 'boxaCreate', 'boxaDestroy', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

2105

Reachable functions

2116

Percentage of reachable functions covered

0.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc3_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/boxbasic.c	32
/src/leptonica/src/utils2.c	31
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	26
/src/leptonica/src/pix2.c	34
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	18
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/boxfunc2.c	6
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/ptra.c	11
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/boxfunc1.c	6
/src/leptonica/src/boxfunc3.c	7
/src/leptonica/src/graphics.c	8
/src/leptonica/src/ptabasic.c	9
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/ptafunc2.c	1
/src/leptonica/src/map.c	4
/src/leptonica/src/rbtree.c	20
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/pageseg.c	1
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1

Fuzzer: compare_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8995	94.4%
gold	[1:9]	2	0.02%
yellow	[10:29]	11	0.11%
greenyellow	[30:49]	3	0.03%
lawngreen	50+	512	5.37%
All colors	9523	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3938	3938	1 : View List ['pixScaleByIntSampling']	3938	83790	pixGetPerceptualDiff	call site: 00486	/src/leptonica/src/compare.c:1741
3348	3348	2 : View List ['pixGetAverageMasked', 'pixAbsDifference']	3348	3828	pixCompareRGB	call site: 09320	/src/leptonica/src/compare.c:1175
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01203	/src/leptonica/src/pix2.c:2038
1116	1116	2 : View List ['pixGetAverageMasked', 'pixAbsDifference']	1116	1196	pixCompareGray	call site: 09107	/src/leptonica/src/compare.c:1040
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00570	/src/leptonica/src/pix2.c:2488
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 09439	/src/leptonica/src/compare.c:278
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00235	/src/leptonica/src/pixconv.c:3071
209	350	4 : View List ['pixcmapAddColor', 'pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap']	209	350	pixConvert2To8	call site: 00378	/src/leptonica/src/pixconv.c:2468
170	311	4 : View List ['pixcmapAddColor', 'pixSetColormap', 'pixcmapCreate', 'pixcmapConvertTo8']	170	311	pixConvert4To8	call site: 00410	/src/leptonica/src/pixconv.c:2571
161	538	2 : View List ['pixCopy', 'pixAddGrayColormap8']	161	538	pixConvertTo8	call site: 00416	/src/leptonica/src/pixconv.c:3083
161	161	1 : View List ['pixAddGrayColormap8']	161	201	pixConvertTo8	call site: 00455	/src/leptonica/src/pixconv.c:3098
161	161	1 : View List ['pixAddGrayColormap8']	161	161	pixConvertTo8	call site: 00429	/src/leptonica/src/pixconv.c:3092

Runtime coverage analysis

Covered functions

115

Functions that are reachable but not covered

1851

Reachable functions

1967

Percentage of reachable functions covered

5.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/compare_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	6
/src/leptonica/src/utils2.c	28
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/compare.c	8
/src/leptonica/src/scale1.c	30
/src/leptonica/src/scale2.c	22
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	6
/src/leptonica/src/graymorph.c	6
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/gplot.c	6
/src/leptonica/src/writefile.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	16
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/colormorph.c	1

Fuzzer: pix1_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	66	45.5%
gold	[1:9]	4	2.75%
yellow	[10:29]	6	4.13%
greenyellow	[30:49]	1	0.68%
lawngreen	50+	68	46.8%
All colors	145	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	31	4 : View List ['pixGetHeight', 'pixdata_malloc', 'pixGetWpl', 'returnErrorPtr']	0	42	pixExtractData	call site: 00135	/src/leptonica/src/pix1.c:1756
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	5	1 : View List ['lept_stderr']	0	5	pixcmapDestroy	call site: 00057	/src/leptonica/src/colormap.c:276
0	0	None	14	140	pixcmapIsValid	call site: 00096	/src/leptonica/src/colormap.c:314

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

3

Reachable functions

45

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix1_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/utils2.c	1

Fuzzer: ccbord_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	806	57.8%
gold	[1:9]	7	0.50%
yellow	[10:29]	10	0.71%
greenyellow	[30:49]	1	0.07%
lawngreen	50+	569	40.8%
All colors	1393	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 01030	/src/leptonica/src/compare.c:267
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 01036	/src/leptonica/src/compare.c:278
72	72	1 : View List ['ptaCopy']	72	72	ptaaGetPta	call site: 01222	/src/leptonica/src/ptabasic.c:1074
48	48	1 : View List ['pixAlphaIsOpaque']	10080	11053	pixEqualWithAlpha	call site: 00713	/src/leptonica/src/compare.c:218
48	48	1 : View List ['pixSetAllArbitrary']	48	420	pixAddBorderGeneral	call site: 00593	/src/leptonica/src/pix2.c:1907
36	110	2 : View List ['pixcmapGetColor', 'pixGetPixel']	36	110	pixEqualWithCmap	call site: 00737	/src/leptonica/src/compare.c:416
29	36	2 : View List ['returnErrorInt', 'ccbaExtendArray']	29	36	ccbaAddCcb	call site: 01140	/src/leptonica/src/ccbord.c:467
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00206	/src/leptonica/src/utils2.c:352
24	141	10 : View List ['pixGetDimensions', 'pixSetWidth', 'pixSetHeight', 'pixFreeAndSetData', 'pixGetWpl', 'pixCopyResolution', 'pixdata_malloc', 'pixSetDepth', 'returnErrorInt', 'pixSetWpl']	24	141	pixResizeImageData	call site: 00227	/src/leptonica/src/pix1.c:762
18	18	1 : View List ['numaaDestroy']	18	40	ccbDestroy	call site: 00519	/src/leptonica/src/ccbord.c:433
0	388	2 : View List ['pixCopy', 'pixClone']	0	511	pixaAddPix	call site: 00463	/src/leptonica/src/pixabasic.c:505
0	377	1 : View List ['pixCopy']	0	377	pixaGetPix	call site: 00534	/src/leptonica/src/pixabasic.c:662

Runtime coverage analysis

Covered functions

166

Functions that are reachable but not covered

53

Reachable functions

218

Percentage of reachable functions covered

75.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/ccbord_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	17
/src/leptonica/src/pix2.c	10
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	6
/src/leptonica/src/ccbord.c	19
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/boxbasic.c	15
/src/leptonica/src/utils2.c	4
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/ptabasic.c	16
/src/leptonica/src/numabasic.c	13
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/ptafunc1.c	4

Fuzzer: barcode_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7261	87.3%
gold	[1:9]	7	0.08%
yellow	[10:29]	16	0.19%
greenyellow	[30:49]	68	0.81%
lawngreen	50+	962	11.5%
All colors	8314	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1523	1523	1 : View List ['pixRotateShearCenter']	1523	1643	pixRotate	call site: 07465	/src/leptonica/src/rotate.c:173
1308	1308	1 : View List ['pixReduceRankBinaryCascade']	7422	16383	pixFindSkewSweepAndSearchScorePivot	call site: 07230	/src/leptonica/src/skew.c:716
1149	1149	1 : View List ['pixRotateAMColor']	1149	1269	pixRotate	call site: 07553	/src/leptonica/src/rotate.c:185
873	873	1 : View List ['pixExtractBarcodeWidths2']	873	880	pixReadBarcodeWidths	call site: 07747	/src/leptonica/src/readbarcode.c:356
694	1760	4 : View List ['pixVShear', 'pixGetColormap', 'pixVShearIP', 'pixDestroy']	694	2137	pixVShear	call site: 07245	/src/leptonica/src/shear.c:251
582	582	1 : View List ['pixRotateBySampling']	582	702	pixRotate	call site: 07466	/src/leptonica/src/rotate.c:175
470	470	1 : View List ['pixRotate180']	470	827	pixRotateOrth	call site: 07136	/src/leptonica/src/rotateorth.c:85
388	388	1 : View List ['boxaBinSort']	388	388	boxaSort	call site: 07619	/src/leptonica/src/boxfunc2.c:653
322	322	1 : View List ['pixcmapAddBlackOrWhite']	3576	6034	pixRotate	call site: 07444	/src/leptonica/src/rotate.c:153
305	305	1 : View List ['pixConvert1To8Cmap']	305	305	pixConvertTo8	call site: 00147	/src/leptonica/src/pixconv.c:3071
209	350	4 : View List ['pixcmapAddColor', 'pixcmapCreate', 'pixcmapConvertTo8', 'pixSetColormap']	209	350	pixConvert2To8	call site: 00384	/src/leptonica/src/pixconv.c:2468
170	311	4 : View List ['pixcmapAddColor', 'pixSetColormap', 'pixcmapCreate', 'pixcmapConvertTo8']	170	311	pixConvert4To8	call site: 00416	/src/leptonica/src/pixconv.c:2571

Runtime coverage analysis

Covered functions

240

Functions that are reachable but not covered

1362

Reachable functions

1602

Percentage of reachable functions covered

14.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/barcode_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	25
/src/leptonica/src/pix2.c	25
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	7
/src/leptonica/src/readbarcode.c	19
/src/leptonica/src/bardecode.c	11
/src/leptonica/src/pixconv.c	17
/src/leptonica/src/utils2.c	29
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/edge.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morph.c	8
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	9
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/writefile.c	6
/src/leptonica/src/scale2.c	16
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	16
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	10
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/rotateorth.c	8
/src/leptonica/src/skew.c	3
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/shear.c	7
/src/leptonica/src/numafunc1.c	10
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/gplot.c	6
/src/leptonica/src/numafunc2.c	6

Fuzzer: checkerboard_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7196	89.3%
gold	[1:9]	5	0.06%
yellow	[10:29]	5	0.06%
greenyellow	[30:49]	6	0.07%
lawngreen	50+	839	10.4%
All colors	8051	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
22743	25371	5 : View List ['pixWrite', 'lept_mkdir', 'selaDisplayInPix', 'pixDisplay', 'pixDestroy']	22743	25388	selaMakeThinSets	call site: 02431	/src/leptonica/src/ccthin.c:455
3812	3812	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5366	5524	pixScaleGeneral	call site: 01001	/src/leptonica/src/scale1.c:450
2120	3666	4 : View List ['pixExtractBorderConnComps', 'pixSubtract', 'pixInvert', 'pixDestroy']	2120	3726	pixThinConnectedBySet	call site: 07956	/src/leptonica/src/ccthin.c:295
1947	1987	3 : View List ['pixConvertTo8', 'pixThresholdToBinary', 'pixDestroy']	1947	1987	pixConvertTo1	call site: 01915	/src/leptonica/src/pixconv.c:2968
1906	1906	1 : View List ['pixScaleGrayLI']	3460	3618	pixScaleGeneral	call site: 01002	/src/leptonica/src/scale1.c:462
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1928	pixScaleColorLI	call site: 01449	/src/leptonica/src/scale1.c:605
1906	1906	1 : View List ['pixScaleColor2xLI']	1906	1906	pixScaleColorLI	call site: 01386	/src/leptonica/src/scale1.c:587
1906	1906	1 : View List ['pixScaleColor4xLI']	1906	1906	pixScaleColorLI	call site: 01387	/src/leptonica/src/scale1.c:589
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 07908	/src/leptonica/src/compare.c:267
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 01002	/src/leptonica/src/scale1.c:467
864	869	2 : View List ['pixRemoveColormap', 'lept_stderr']	864	927	pixConvertTo8Or32	call site: 00991	/src/leptonica/src/pixconv.c:3415
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 07914	/src/leptonica/src/compare.c:278

Runtime coverage analysis

Covered functions

237

Functions that are reachable but not covered

1335

Reachable functions

1570

Percentage of reachable functions covered

14.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/checkerboard_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	28
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	9
/src/leptonica/src/pixabasic.c	16
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/utils2.c	27
/src/leptonica/src/checkerboard.c	3
/src/leptonica/src/morph.c	8
/src/leptonica/src/sel1.c	27
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/rotateorth.c	1
/src/leptonica/src/pixafunc2.c	3
/src/leptonica/src/pixafunc1.c	9
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	16
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/graphics.c	5
/src/leptonica/src/ptabasic.c	8
/src/leptonica/src/ptafunc1.c	3
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	8
/src/leptonica/src/morphapp.c	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/ccthin.c	3
/src/leptonica/src/sel2.c	4
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/writefile.c	6
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/compare.c	5
/src/leptonica/src/seedfill.c	3
/src/leptonica/src/boxfunc2.c	1

Fuzzer: dewarp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11125	89.9%
gold	[1:9]	12	0.09%
yellow	[10:29]	20	0.16%
greenyellow	[30:49]	64	0.51%
lawngreen	50+	1143	9.24%
All colors	12364	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
67981	68099	10 : View List ['pixGetHeight', 'pixRenderHorizEndPoints', 'applyQuadraticFit', 'pixWriteDebug', 'ptaTranspose', 'pixDisplayPta', 'pixDestroy', 'convertFilesToPdf', 'pixDisplay', 'lept_stderr']	67981	69273	dewarpFindHorizDisparity	call site: 11158	/src/leptonica/src/dewarp2.c:688
61879	62171	7 : View List ['dewarpPopulateFullRes', 'fpixRenderContours', 'lept_stderr', 'pixWriteDebug', 'convertFilesToPdf', 'pixDisplay', 'pixDestroy']	61879	62188	dewarpBuildPageModel	call site: 10969	/src/leptonica/src/dewarp2.c:250
27194	27213	4 : View List ['convertFilesToPdf', 'dewarpDebug', 'dewarpaGetDewarp', 'lept_stderr']	27194	27285	dewarpaApplyDisparity	call site: 12031	/src/leptonica/src/dewarp3.c:176
26057	26068	11 : View List ['srand', 'generatePtaFilledCircle', 'pixDisplayPtaaPattern', 'pixClone', 'pixRenderMidYs', 'pixWriteDebug', 'pixRotateOrth', 'pixGenerateFromPta', 'numaWriteDebug', 'pixDisplay', 'pixConvertTo32']	43136	44659	dewarpFindVertDisparity	call site: 08888	/src/leptonica/src/dewarp2.c:430
23648	24068	5 : View List ['pixCreateTemplate', 'pixDisplayPtaa', 'pixWriteDebug', 'pixDisplayWithTitle', 'pixDestroy']	23648	24188	dewarpGetTextlineCenters	call site: 08430	/src/leptonica/src/dewarp2.c:890
22465	22465	2 : View List ['pixWriteDebug', 'pixDisplayWithTitle']	49659	49750	dewarpaApplyDisparity	call site: 12015	/src/leptonica/src/dewarp3.c:165
16623	16628	3 : View List ['ptaaWriteDebug', 'convertFilesToPdf', 'lept_stderr']	16623	16899	dewarpFindVertDisparity	call site: 09057	/src/leptonica/src/dewarp2.c:512
13712	13712	2 : View List ['pixGetBackgroundRGBMap', 'pixApplyInvBackgroundRGBMap']	13712	18638	pixBackgroundNorm	call site: 00495	/src/leptonica/src/adaptmap.c:375
13080	13537	4 : View List ['pixDisplayPtaa', 'pixCopy', 'pixDestroy', 'pixDisplayWithTitle']	13080	13561	dewarpRemoveShortLines	call site: 08586	/src/leptonica/src/dewarp2.c:1002
12492	12492	3 : View List ['lept_mkdir', 'lept_rmdir', 'pixDisplayWithTitle']	110929	172811	dewarpBuildPageModel	call site: 08122	/src/leptonica/src/dewarp2.c:170
11772	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11772	11846	pixMorphSequence	call site: 07157	/src/leptonica/src/morphseq.c:243
3508	3548	3 : View List ['pixSmoothConnectedRegions', 'pixScaleBySampling', 'pixDestroy']	3508	3578	pixGetBackgroundGrayMap	call site: 07497	/src/leptonica/src/adaptmap.c:1033

Runtime coverage analysis

Covered functions

310

Functions that are reachable but not covered

1990

Reachable functions

2299

Percentage of reachable functions covered

13.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/dewarp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	16
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	48
/src/leptonica/src/colormap.c	32
/src/leptonica/src/pix2.c	32
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	10
/src/leptonica/src/dewarp4.c	10
/src/leptonica/src/pixconv.c	23
/src/leptonica/src/utils2.c	32
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/grayquant.c	5
/src/leptonica/src/adaptmap.c	9
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	15
/src/leptonica/src/pixabasic.c	14
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	15
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/numabasic.c	29
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/jpegio.c	10
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	4
/src/libpng/pngwrite.c	14
/src/libpng/png.c	33
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	12
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	15
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	30
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	9
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	3
/src/leptonica/src/jp2kiostub.c	4
/src/leptonica/src/webpio.c	4
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	8
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	6
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	11
/src/leptonica/src/ptabasic.c	25
/src/leptonica/src/numafunc1.c	14
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/dewarp1.c	12
/src/leptonica/src/dewarp2.c	15
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/compare.c	5
/src/leptonica/src/pixafunc1.c	3
/src/leptonica/src/boxfunc4.c	1
/src/leptonica/src/ptafunc1.c	16
/src/leptonica/src/graphics.c	7
/src/leptonica/src/rotateorth.c	8
/src/leptonica/src/affine.c	1
/src/leptonica/src/ptafunc2.c	5
/src/leptonica/src/sarray2.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/libpng/pngread.c	12
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/libpng/pngrtran.c	32
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/dewarp3.c	6
/src/leptonica/src/fpix2.c	5
/src/leptonica/src/pageseg.c	1
/src/leptonica/src/skew.c	6
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/gplot.c	8
/src/leptonica/src/numafunc2.c	2
/src/leptonica/src/pixcomp.c	14

Fuzzer: edge_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5823	97.9%
gold	[1:9]	4	0.06%
yellow	[10:29]	6	0.10%
greenyellow	[30:49]	8	0.13%
lawngreen	50+	103	1.73%
All colors	5944	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11720	11792	8 : View List ['pixGetColormap', 'pixWrite', 'pixcmapGetCount', 'pixSetPixel', 'pixConvertTo8', 'numaGetIValue', 'pixcmapAddColor', 'pixDestroy']	11720	11792	pixGetEdgeProfile	call site: 00215	/src/leptonica/src/edge.c:465
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	22	1 : View List ['numaCreate']	0	246	numaFindExtrema	call site: 05928	/src/leptonica/src/numafunc2.c:2508
0	19	2 : View List ['numaDestroy', 'returnErrorPtr']	0	19	numaCreate	call site: 00148	/src/leptonica/src/numabasic.c:201
0	7	1 : View List ['returnErrorInt']	0	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorInt']	0	7	pixMeasureEdgeSmoothness	call site: 00141	/src/leptonica/src/edge.c:335
0	7	1 : View List ['returnErrorInt']	0	7	pixGetLastOnPixelInRun	call site: 00189	/src/leptonica/src/edge.c:598
0	7	1 : View List ['returnErrorInt']	0	7	numaAddNumber	call site: 00173	/src/leptonica/src/numabasic.c:470
0	7	1 : View List ['returnErrorInt']	0	7	numaGetFValue	call site: 05932	/src/leptonica/src/numabasic.c:697
0	7	1 : View List ['returnErrorInt']	0	7	numaGetIValue	call site: 00559	/src/leptonica/src/numabasic.c:732
0	7	1 : View List ['returnErrorInt']	0	7	numaExtendArray	call site: 00177	/src/leptonica/src/numabasic.c:504

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

1268

Reachable functions

1323

Percentage of reachable functions covered

4.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/edge_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	20
/src/leptonica/src/pix2.c	14
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/edge.c	4
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/utils2.c	23
/src/leptonica/src/pixconv.c	15
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/writefile.c	4
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/boxbasic.c	4
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/bytearray.c	7
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	8
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc2.c	1

Fuzzer: mask_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7693	91.3%
gold	[1:9]	8	0.09%
yellow	[10:29]	13	0.15%
greenyellow	[30:49]	5	0.05%
lawngreen	50+	701	8.32%
All colors	8420	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11772	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11772	11846	pixMorphSequence	call site: 07136	/src/leptonica/src/morphseq.c:243
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 00698	/src/leptonica/src/pix2.c:2038
1089	1100	2 : View List ['pixGetSpp', 'pixGetRGBComponent']	3085	7795	pixBlendWithGrayMask	call site: 01711	/src/leptonica/src/blend.c:1714
998	1009	2 : View List ['pixConvertTo32', 'pixClone']	998	1820	pixBlendWithGrayMask	call site: 01725	/src/leptonica/src/blend.c:1743
907	907	1 : View List ['pixConvert2To8']	907	907	pixConvertTo8	call site: 00767	/src/leptonica/src/pixconv.c:3075
907	907	1 : View List ['pixConvert4To8']	907	907	pixConvertTo8	call site: 00768	/src/leptonica/src/pixconv.c:3077
886	886	1 : View List ['pixCloseBrick']	886	886	pixCloseSafeBrick	call site: 00611	/src/leptonica/src/morph.c:973
829	829	1 : View List ['pixClose']	829	2611	pixCloseSafeBrick	call site: 00640	/src/leptonica/src/morph.c:980
829	829	1 : View List ['pixOpen']	829	907	pixOpenBrick	call site: 00574	/src/leptonica/src/morph.c:825
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 07554	/src/leptonica/src/compare.c:278
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 07877	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 07895	/src/leptonica/src/pixconv.c:1892

Runtime coverage analysis

Covered functions

203

Functions that are reachable but not covered

1399

Reachable functions

1602

Percentage of reachable functions covered

12.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/mask_fuzzer.cc	2
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	15
/src/leptonica/src/colorcontent.c	2
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	6
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/seedfill.c	6
/src/leptonica/src/compare.c	5
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/numafunc2.c	3
/src/leptonica/src/rotateorth.c	5

Fuzzer: pix_rotate_shear_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3842	80.9%
gold	[1:9]	86	1.81%
yellow	[10:29]	19	0.40%
greenyellow	[30:49]	34	0.71%
lawngreen	50+	767	16.1%
All colors	4748	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 04536	/src/leptonica/src/pix2.c:2488
694	1760	4 : View List ['pixVShear', 'pixGetColormap', 'pixVShearIP', 'pixDestroy']	694	2137	pixVShear	call site: 04484	/src/leptonica/src/shear.c:251
684	1740	4 : View List ['pixGetColormap', 'pixHShearIP', 'pixHShear', 'pixDestroy']	684	2117	pixHShear	call site: 04354	/src/leptonica/src/shear.c:132
610	616	2 : View List ['VP8DecompressAlphaRows', 'VP8SetError']	610	616	FinishRow	call site: 03819	/src/libwebp/src/dec/frame_dec.c:465
158	158	2 : View List ['InitRGBRescaler', 'InitYUVRescaler']	158	158	CustomSetup	call site: 00000	/src/libwebp/src/dec/io_dec.c:587
65	65	1 : View List ['EmitRescaledRowsRGBA']	65	65	ProcessRows	call site: 04247	/src/libwebp/src/dec/vp8l_dec.c:842
47	47	2 : View List ['EmitRescaledRowsYUVA', 'EmitRowsYUVA']	47	47	ProcessRows	call site: 04247	/src/libwebp/src/dec/vp8l_dec.c:836
35	35	1 : View List ['rasteropUniGeneralLow']	35	35	rasteropUniLow	call site: 00319	/src/leptonica/src/roplow.c:178
33	40	2 : View List ['numaExtendArray', 'returnErrorInt']	33	40	numaAddNumber	call site: 04391	/src/leptonica/src/numabasic.c:469
28	28	1 : View List ['stringNew']	28	28	stringReplace	call site: 00213	/src/leptonica/src/utils2.c:352
24	141	10 : View List ['pixGetDimensions', 'pixSetWidth', 'pixSetHeight', 'pixFreeAndSetData', 'pixGetWpl', 'pixCopyResolution', 'pixdata_malloc', 'pixSetDepth', 'returnErrorInt', 'pixSetWpl']	24	141	pixResizeImageData	call site: 00232	/src/leptonica/src/pix1.c:762
24	24	2 : View List ['WebPRescalerGetScaledDimensions', 'WebPCheckCropDimensions']	31	65	WebPAllocateDecBuffer	call site: 03690	/src/libwebp/src/dec/buffer_dec.c:188

Runtime coverage analysis

Covered functions

447

Functions that are reachable but not covered

750

Reachable functions

1048

Percentage of reachable functions covered

28.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix_rotate_shear_fuzzer.cc	2
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	6
/src/leptonica/src/readfile.c	2
/src/leptonica/src/bmpio.c	1
/src/leptonica/src/pix1.c	44
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	13
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/utils2.c	5
/src/leptonica/src/pixconv.c	11
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	14
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	1
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	2
/src/leptonica/src/rotateshear.c	3
/src/leptonica/src/shear.c	5
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1

Fuzzer: pix3_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10035	95.7%
gold	[1:9]	3	0.02%
yellow	[10:29]	33	0.31%
greenyellow	[30:49]	12	0.11%
lawngreen	50+	393	3.75%
All colors	10476	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16291	17309	6 : View List ['pixThresholdToBinary', 'pixSetMasked', 'pixGetRGBComponent', 'pixDestroy', 'pixDisplay', 'pixDisplayLayersRGBA']	16291	17686	pixSetUnderTransparency	call site: 10410	/src/leptonica/src/pix3.c:1198
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00752	/src/leptonica/src/readfile.c:197
148	176	3 : View List ['pixGetDimensions', 'pixGetColormap', 'pixGetPixel']	148	197	pixAbsDiffOnLine	call site: 00331	/src/leptonica/src/pix3.c:3195
143	1856	22 : View List ['pixcmapToArrays', 'pixCopy', 'returnErrorPtr', 'pixSetSpp', 'pixGetData', 'pixcmapIsOpaque', 'composeRGBAPixel', 'pixInvert', 'pixDestroyColormap', 'pixGetDimensions', 'free', 'calloc', 'pixcmapGetColor', 'pixcmapGetCount', 'composeRGBPixel', 'pixcmapIsBlackAndWhite', 'pixGetWpl', 'pixCopyResolution', 'pixCopyInputFormat', 'pixCreate', 'pixcmapHasColor', 'lept_stderr']	143	1856	pixRemoveColormap	call site: 00661	/src/leptonica/src/pixconv.c:338
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00545	/src/leptonica/src/roplow.c:569
35	35	1 : View List ['rasteropUniGeneralLow']	35	35	rasteropUniLow	call site: 00532	/src/leptonica/src/roplow.c:178
33	40	2 : View List ['numaExtendArray', 'returnErrorInt']	33	40	numaAddNumber	call site: 00274	/src/leptonica/src/numabasic.c:469
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00771	/src/leptonica/src/utils2.c:3165
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00755	/src/leptonica/src/utils2.c:3104
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	28	1 : View List ['stringNew']	0	28	stringReplace	call site: 00191	/src/leptonica/src/utils2.c:352
0	25	2 : View List ['boxaDestroy', 'returnErrorPtr']	0	25	boxaCreate	call site: 00427	/src/leptonica/src/boxbasic.c:453

Runtime coverage analysis

Covered functions

132

Functions that are reachable but not covered

1946

Reachable functions

2079

Percentage of reachable functions covered

6.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pix3_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	26
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	4
/src/leptonica/src/pix3.c	35
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/utils2.c	30
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/numabasic.c	22
/src/leptonica/src/numafunc1.c	7
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/pix5.c	3
/src/leptonica/src/seedfill.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/numafunc2.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/writefile.c	7
/src/leptonica/src/blend.c	6
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6

Fuzzer: colorquant_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7439	81.7%
gold	[1:9]	8	0.08%
yellow	[10:29]	24	0.26%
greenyellow	[30:49]	33	0.36%
lawngreen	50+	1593	17.5%
All colors	9097	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphSequence	call site: 07548	/src/leptonica/src/morphseq.c:243
10568	10568	1 : View List ['pixWriteDebug']	10568	11786	pixColorSegment	call site: 08672	/src/leptonica/src/colorseg.c:166
3812	3812	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	5366	5524	pixScaleGeneral	call site: 00769	/src/leptonica/src/scale1.c:450
3812	3812	2 : View List ['pixScaleAreaMap2', 'pixScaleAreaMap']	3812	56172	pixColorsForQuantization	call site: 01609	/src/leptonica/src/colorcontent.c:1329
1943	1948	2 : View List ['pixWriteJpeg', 'lept_stderr']	1943	1948	pixWriteImpliedFormat	call site: 08433	/src/leptonica/src/writefile.c:507
1906	1906	1 : View List ['pixScaleGrayLI']	3460	3618	pixScaleGeneral	call site: 00770	/src/leptonica/src/scale1.c:462
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1928	pixScaleColorLI	call site: 01219	/src/leptonica/src/scale1.c:605
1906	1906	1 : View List ['pixScaleColor2xLI']	1906	1906	pixScaleColorLI	call site: 01155	/src/leptonica/src/scale1.c:587
1906	1906	1 : View List ['pixScaleColor4xLI']	1906	1906	pixScaleColorLI	call site: 01156	/src/leptonica/src/scale1.c:589
1554	1554	1 : View List ['pixUnsharpMasking']	1554	1701	pixScaleGeneral	call site: 00770	/src/leptonica/src/scale1.c:467
1481	1481	1 : View List ['pixRotate3Shear']	1481	1481	pixRotateShear	call site: 08277	/src/leptonica/src/rotateshear.c:227
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 01973	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

414

Functions that are reachable but not covered

1262

Reachable functions

1671

Percentage of reachable functions covered

24.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/colorquant_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	50
/src/leptonica/src/colormap.c	32
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	9
/src/leptonica/src/grayquant.c	12
/src/leptonica/src/pixconv.c	21
/src/leptonica/src/utils2.c	32
/src/leptonica/src/rop.c	3
/src/leptonica/src/roplow.c	10
/src/leptonica/src/boxbasic.c	16
/src/leptonica/src/coloring.c	1
/src/leptonica/src/paintcmap.c	4
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/scale1.c	29
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/colorquant1.c	23
/src/leptonica/src/colorquant2.c	16
/src/leptonica/src/colorcontent.c	4
/src/leptonica/src/heap.c	9
/src/leptonica/src/numafunc1.c	6
/src/leptonica/src/edge.c	1
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/morph.c	15
/src/leptonica/src/sel1.c	9
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	10
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/skew.c	6
/src/leptonica/src/shear.c	7
/src/leptonica/src/rotate.c	3
/src/leptonica/src/rotateshear.c	4
/src/leptonica/src/rotateam.c	4
/src/leptonica/src/colorseg.c	6

Fuzzer: maze_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	375	60.4%
gold	[1:9]	27	4.35%
yellow	[10:29]	5	0.80%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	212	34.1%
All colors	620	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1141	1158	4 : View List ['pixcmapGetColor', 'pixInvert', 'pixCopy', 'pixDestroyColormap']	1141	1163	pixRemoveColormap	call site: 00458	/src/leptonica/src/pixconv.c:385
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 00216	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 00250	/src/leptonica/src/pixconv.c:1892
416	416	1 : View List ['pixConvert1To8']	416	438	pixUnpackBinary	call site: 00270	/src/leptonica/src/pixconv.c:1897
416	416	1 : View List ['pixConvert1To16']	416	438	pixUnpackBinary	call site: 00291	/src/leptonica/src/pixconv.c:1902
103	103	3 : View List ['pixcmapIsBlackAndWhite', 'pixcmapIsOpaque', 'pixcmapHasColor']	1259	1772	pixRemoveColormap	call site: 00442	/src/leptonica/src/pixconv.c:367
23	23	1 : View List ['lstackDestroy']	23	23	lqueueDestroy	call site: 00170	/src/leptonica/src/queue.c:156
11	11	1 : View List ['pixClone']	11	11	pixRemoveColormap	call site: 00425	/src/leptonica/src/pixconv.c:338
7	18	2 : View List ['pixcmapGetCount', 'returnErrorInt']	7	18	pixSetAll	call site: 00373	/src/leptonica/src/pix2.c:806
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	lheapAdd	call site: 00396	/src/leptonica/src/heap.c:199
7	7	1 : View List ['returnErrorInt']	7	7	lheapExtendArray	call site: 00396	/src/leptonica/src/heap.c:225

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

41

Reachable functions

124

Percentage of reachable functions covered

66.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/maze_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	12
/src/leptonica/src/pix2.c	6
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/maze.c	4
/src/leptonica/src/queue.c	6
/src/leptonica/src/stack.c	2
/src/leptonica/src/utils2.c	4
/src/leptonica/src/pixconv.c	8
/src/leptonica/src/ptabasic.c	4
/src/leptonica/src/heap.c	8
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7

Fuzzer: pixconv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7358	94.5%
gold	[1:9]	8	0.10%
yellow	[10:29]	25	0.32%
greenyellow	[30:49]	11	0.14%
lawngreen	50+	379	4.87%
All colors	7781	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphSequence	call site: 07256	/src/leptonica/src/morphseq.c:243
3812	3812	2 : View List ['pixScaleAreaMap2', 'pixScaleAreaMap']	24940	56172	pixColorsForQuantization	call site: 00640	/src/leptonica/src/colorcontent.c:1329
1167	1221	2 : View List ['pixSwapAndDestroy', 'pixRemoveBorder']	12999	13067	pixMorphSequence	call site: 07254	/src/leptonica/src/morphseq.c:238
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00477	/src/leptonica/src/pix2.c:2488
913	913	1 : View List ['pixThresholdOn8bpp']	913	982	pixQuantizeIfFewColors	call site: 07771	/src/leptonica/src/pixconv.c:1691
416	416	1 : View List ['pixConvert1To2']	416	438	pixUnpackBinary	call site: 07595	/src/leptonica/src/pixconv.c:1887
416	416	1 : View List ['pixConvert1To4']	416	438	pixUnpackBinary	call site: 07612	/src/leptonica/src/pixconv.c:1892
116	363	4 : View List ['pixcmapCopy', 'returnErrorInt', 'pixcmapIsValid', 'pixSetColormap']	116	363	pixCopyColormap	call site: 00230	/src/leptonica/src/pix1.c:813
103	103	3 : View List ['pixcmapIsBlackAndWhite', 'pixcmapIsOpaque', 'pixcmapHasColor']	165	1772	pixRemoveColormap	call site: 00190	/src/leptonica/src/pixconv.c:367
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00317	/src/leptonica/src/roplow.c:569
79	83	2 : View List ['extractRGBValues', 'pixSetMaskedCmap']	79	83	pixSetMasked	call site: 07559	/src/leptonica/src/pix3.c:177
75	75	1 : View List ['pixaCreate']	32106	33724	pixMorphSequence	call site: 01323	/src/leptonica/src/morphseq.c:166

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

1414

Reachable functions

1544

Percentage of reachable functions covered

8.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/pixconv_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	5
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	27
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	5
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/utils2.c	30
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	7
/src/leptonica/src/grayquant.c	10
/src/leptonica/src/colorcontent.c	4
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	17
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/edge.c	1
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	16
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	19
/src/leptonica/src/bytearray.c	10
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	12
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/leptonica/src/pngio.c	1
/src/libpng/pngwrite.c	14
/src/libpng/png.c	13
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/libpng/pngset.c	10
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/libpng/pngtrans.c	7
/src/libpng/pngwtran.c	5
/src/leptonica/src/tiffio.c	17
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	10
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	12
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	114
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/pnmio.c	2
/src/leptonica/src/psio2.c	5
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/src/dsp/alpha_processing.c	2
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	2
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless.c	2
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	1
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/libjpeg-turbo/src/jdapimin.c	5
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	3
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/readfile.c	3
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/colorquant1.c	4

Fuzzer: colorfill_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	49.7%
gold	[1:9]	32	14.4%
yellow	[10:29]	9	4.07%
greenyellow	[30:49]	2	0.90%
lawngreen	50+	68	30.7%
All colors	221	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
46	57	3 : View List ['returnErrorInt', 'boxaExtendArray', 'boxDestroy']	46	57	boxaAddBox	call site: 00165	/src/leptonica/src/boxbasic.c:577
45	45	2 : View List ['boxClone', 'boxCopy']	105	127	boxaAddBox	call site: 00157	/src/leptonica/src/boxbasic.c:565
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	25	2 : View List ['boxaDestroy', 'returnErrorPtr']	0	25	boxaCreate	call site: 00142	/src/leptonica/src/boxbasic.c:453
0	25	2 : View List ['l_dnaaDestroy', 'returnErrorPtr']	0	25	l_dnaaCreate	call site: 00196	/src/leptonica/src/dnabasic.c:1194
0	25	2 : View List ['numaaDestroy', 'returnErrorPtr']	0	25	numaaCreate	call site: 00188	/src/leptonica/src/numabasic.c:1314
0	7	1 : View List ['returnErrorPtr']	2	24	boxCreate	call site: 00150	/src/leptonica/src/boxbasic.c:186

Runtime coverage analysis

Covered functions

54

Functions that are reachable but not covered

10

Reachable functions

66

Percentage of reachable functions covered

84.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/colorfill_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/colorfill.c	2
/src/leptonica/src/boxbasic.c	11
/src/leptonica/src/utils2.c	1
/src/leptonica/src/numabasic.c	3
/src/leptonica/src/dnabasic.c	3
/src/leptonica/src/pixabasic.c	2

Fuzzer: affine_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5376	96.2%
gold	[1:9]	3	0.05%
yellow	[10:29]	5	0.08%
greenyellow	[30:49]	6	0.10%
lawngreen	50+	196	3.50%
All colors	5586	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00742	/src/leptonica/src/readfile.c:197
7037	7801	13 : View List ['atan2', 'pixHShearIP', 'pixRasteropIP', 'pixCopy', 'pixClone', 'lept_stderr', 'ptaGetCount', 'pixVShearIP', 'ptaGetIPt', 'pixScale', 'pixAddBorderGeneral', 'pixRemoveBorderGeneral', 'pixDestroy']	7037	7829	pixAffineSequential	call site: 04923	/src/leptonica/src/affine.c:1459
2547	4368	9 : View List ['pixConvertTo8', 'pixClone', 'ptaGetCount', 'pixRemoveColormap', 'pixAffinePtaGray', 'pixAffineSampledPta', 'pixGetDepth', 'pixAffinePtaColor', 'pixDestroy']	2547	4375	pixAffinePta	call site: 00147	/src/leptonica/src/affine.c:438
1233	1244	4 : View List ['free', 'ptaGetCount', 'pixAffineColor', 'getAffineXformCoeffs']	1233	1251	pixAffinePtaColor	call site: 00660	/src/leptonica/src/affine.c:559
446	457	4 : View List ['free', 'ptaGetCount', 'pixAffineGray', 'getAffineXformCoeffs']	446	464	pixAffinePtaGray	call site: 00632	/src/leptonica/src/affine.c:658
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 00449	/src/leptonica/src/roplow.c:569
31	31	2 : View List ['stringCat', 'strlen']	31	31	genPathname	call site: 00761	/src/leptonica/src/utils2.c:3165
24	24	1 : View List ['pixSetAll']	24	1500	pixAffinePtaWithAlpha	call site: 04874	/src/leptonica/src/affine.c:811
11	11	1 : View List ['pixcmapGetCount']	11	60	pixSetAllArbitrary	call site: 00332	/src/leptonica/src/pix2.c:942
11	11	1 : View List ['pixClone']	11	11	pixAddBorder	call site: 04839	/src/leptonica/src/pix2.c:1792
2	2	1 : View List ['getcwd']	45	94	genPathname	call site: 00745	/src/leptonica/src/utils2.c:3104
0	48	1 : View List ['pixSetAllArbitrary']	0	420	pixAddBorderGeneral	call site: 04848	/src/leptonica/src/pix2.c:1907

Runtime coverage analysis

Covered functions

78

Functions that are reachable but not covered

1069

Reachable functions

1148

Percentage of reachable functions covered

6.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/affine_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	45
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	21
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	2
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/affine.c	15
/src/leptonica/src/utils2.c	13
/src/leptonica/src/numabasic.c	7
/src/leptonica/src/numafunc1.c	1
/src/leptonica/src/pixconv.c	12
/src/leptonica/src/rop.c	4
/src/leptonica/src/roplow.c	10
/src/leptonica/src/readfile.c	4
/src/leptonica/src/tiffio.c	11
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	2
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	4
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	1
/src/libpng/pngread.c	12
/src/libpng/png.c	29
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	6
/src/leptonica/src/gifiostub.c	1
/src/leptonica/src/jp2kiostub.c	1
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/ptafunc1.c	1
/src/leptonica/src/pix5.c	1
/src/leptonica/src/shear.c	3
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3

Fuzzer: binarize_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9625	89.3%
gold	[1:9]	7	0.06%
yellow	[10:29]	11	0.10%
greenyellow	[30:49]	42	0.38%
lawngreen	50+	1091	10.1%
All colors	10776	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
13712	13712	2 : View List ['pixGetBackgroundRGBMap', 'pixApplyInvBackgroundRGBMap']	13712	18638	pixBackgroundNorm	call site: 04440	/src/leptonica/src/adaptmap.c:375
11772	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11772	11846	pixMorphSequence	call site: 09045	/src/leptonica/src/morphseq.c:243
9254	10253	8 : View List ['gplotMakeOutputPix', 'lept_mkdir', 'numaReplaceNumber', 'gplotAddPlot', 'numaGetMax', 'gplotCreate', 'numaMakeConstant', 'gplotDestroy']	9254	10329	pixSplitDistributionFgBg	call site: 10356	/src/leptonica/src/pix4.c:3466
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00136	/src/leptonica/src/readfile.c:197
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 09748	/src/leptonica/src/convolve.c:167
2372	2901	16 : View List ['returnErrorPtr', 'pixScaleAndTransferAlpha', 'pixGetData', 'pixScaleResolution', 'pixGetDimensions', 'pixCopyText', 'pixScaleBinaryWithShift', 'pixCopySpp', 'pixGetSpp', 'pixCopyColormap', 'pixGetDepth', 'pixGetWpl', 'pixCopyInputFormat', 'pixCopyResolution', 'pixCreate', 'scaleBySamplingLow']	2372	2901	pixScaleBySamplingWithShift	call site: 09386	/src/leptonica/src/scale1.c:1359
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1946	pixScaleSmooth	call site: 05189	/src/leptonica/src/scale1.c:1767
1906	1906	1 : View List ['pixScaleGeneral']	1906	1911	pixScaleSmooth	call site: 05187	/src/leptonica/src/scale1.c:1723
1546	3548	3 : View List ['pixSmoothConnectedRegions', 'pixScaleBySampling', 'pixDestroy']	1546	3578	pixGetBackgroundGrayMap	call site: 09381	/src/leptonica/src/adaptmap.c:1033
1167	1221	2 : View List ['pixSwapAndDestroy', 'pixRemoveBorder']	12939	13067	pixMorphSequence	call site: 09043	/src/leptonica/src/morphseq.c:238
1167	1167	1 : View List ['pixRemoveBorder']	1167	3187	pixSauvolaBinarize	call site: 10465	/src/leptonica/src/binarize.c:633
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04816	/src/leptonica/src/pix2.c:2038

Runtime coverage analysis

Covered functions

275

Functions that are reachable but not covered

1838

Reachable functions

2112

Percentage of reachable functions covered

12.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/binarize_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	5
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	31
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	24
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/binarize.c	9
/src/leptonica/src/adaptmap.c	10
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	12
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	17
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	14
/src/leptonica/src/convolve.c	8
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	23
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/conncomp.c	15
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/seedfill.c	6
/src/leptonica/src/graymorph.c	2
/src/leptonica/src/queue.c	6
/src/leptonica/src/pixtiling.c	7
/src/leptonica/src/numafunc2.c	6
/src/leptonica/src/gplot.c	9

Fuzzer: enhance_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5920	82.3%
gold	[1:9]	6	0.08%
yellow	[10:29]	240	3.33%
greenyellow	[30:49]	60	0.83%
lawngreen	50+	967	13.4%
All colors	7193	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3812	3812	2 : View List ['pixScaleSmooth', 'pixScaleAreaMap']	3812	5524	pixScaleGeneral	call site: 06127	/src/leptonica/src/scale1.c:450
1906	1906	1 : View List ['pixScaleGrayLI']	1906	3618	pixScaleGeneral	call site: 06128	/src/leptonica/src/scale1.c:462
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1928	pixScaleColorLI	call site: 06460	/src/leptonica/src/scale1.c:605
1906	1906	1 : View List ['pixScaleColor2xLI']	1906	1906	pixScaleColorLI	call site: 06397	/src/leptonica/src/scale1.c:587
1906	1906	1 : View List ['pixScaleColor4xLI']	1906	1906	pixScaleColorLI	call site: 06398	/src/leptonica/src/scale1.c:589
1442	1442	1 : View List ['TIFFFlush']	1450	1585	TIFFCleanup	call site: 03082	/src/libtiff/libtiff/tif_close.c:49
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 05265	/src/leptonica/src/pix2.c:2038
1085	1125	3 : View List ['pixConvert16To8', 'pixConvert8To32', 'pixDestroy']	1085	1125	pixConvertTo32	call site: 07052	/src/leptonica/src/pixconv.c:3271
1073	1073	1 : View List ['pixGetRGBComponentCmap']	1073	1073	pixGetRGBComponent	call site: 00521	/src/leptonica/src/pix2.c:2488
907	907	1 : View List ['pixConvert2To8']	1783	1823	pixConvertTo32	call site: 07030	/src/leptonica/src/pixconv.c:3259
907	907	1 : View List ['pixConvert4To8']	1783	1823	pixConvertTo32	call site: 07048	/src/leptonica/src/pixconv.c:3264
886	886	1 : View List ['pixCloseBrick']	886	886	pixCloseSafeBrick	call site: 05117	/src/leptonica/src/morph.c:973

Runtime coverage analysis

Covered functions

383

Functions that are reachable but not covered

979

Reachable functions

1345

Percentage of reachable functions covered

27.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/enhance_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	7
/src/leptonica/src/spixio.c	3
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	27
/src/leptonica/src/pix2.c	23
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	8
/src/leptonica/src/utils2.c	17
/src/leptonica/src/enhance.c	27
/src/leptonica/src/numafunc1.c	8
/src/leptonica/src/numabasic.c	10
/src/leptonica/src/pixconv.c	20
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/colorspace.c	2
/src/leptonica/src/pixabasic.c	11
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/bmf.c	11
/src/leptonica/src/encoding.c	4
/src/leptonica/src/readfile.c	5
/src/leptonica/src/bmpio.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/jpegio.c	5
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	3
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	9
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	3
/src/libpng/pngread.c	12
/src/libpng/png.c	30
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/leptonica/src/tiffio.c	22
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	7
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	3
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	7
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	2
/src/leptonica/src/webpio.c	2
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	4
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	6
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/pix5.c	3
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/morph.c	7
/src/leptonica/src/sel1.c	7
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/ptra.c	9
/src/leptonica/src/sarray1.c	9
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/bbuffer.c	3
/src/leptonica/src/scale1.c	27
/src/leptonica/src/scale2.c	22
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/textops.c	5
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/grayquant.c	3
/src/leptonica/src/kernel.c	5

Fuzzer: morphapp_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9938	94.5%
gold	[1:9]	5	0.04%
yellow	[10:29]	7	0.06%
greenyellow	[30:49]	4	0.03%
lawngreen	50+	555	5.28%
All colors	10509	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00136	/src/leptonica/src/readfile.c:197
4804	5184	10 : View List ['pixHMT', 'pixSetAll', 'pixClose', 'pixErode', 'pixDilate', 'pixCreateTemplate', 'pixDestroy', 'pixOpen', 'pixAnd', 'selaGetSel']	4804	5191	pixIntersectionOfMorphOps	call site: 05887	/src/leptonica/src/morphapp.c:558
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 05758	/src/leptonica/src/convolve.c:167
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1906	pixScaleBySamplingWithShift	call site: 05698	/src/leptonica/src/scale1.c:1385
1728	1728	1 : View List ['pixRemoveColormap']	2540	3300	pixEqualWithAlpha	call site: 10398	/src/leptonica/src/compare.c:267
1657	3741	10 : View List ['pixCopy', 'selCreateBrick', 'lept_stderr', 'pixDilate', 'pixCreateTemplate', 'selSetElement', 'selDestroy', 'pixEqual', 'pixAnd', 'pixDestroy']	1657	3748	pixSeedfillMorph	call site: 10297	/src/leptonica/src/morphapp.c:1035
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 06055	/src/leptonica/src/pix2.c:2038
812	822	2 : View List ['pixConvertLossless', 'lept_stderr']	812	1528	pixEqualWithAlpha	call site: 10404	/src/leptonica/src/compare.c:278
425	425	1 : View List ['pixScaleBinaryWithShift']	425	425	pixScaleBySamplingWithShift	call site: 05677	/src/leptonica/src/scale1.c:1365
110	110	2 : View List ['pixcmapGetColor', 'pixGetPixel']	110	110	pixEqualWithCmap	call site: 10337	/src/leptonica/src/compare.c:416
98	98	1 : View List ['rasteropVAlignedLow']	98	98	rasteropLow	call site: 02243	/src/leptonica/src/roplow.c:569
48	48	1 : View List ['pixAlphaIsOpaque']	10080	11053	pixEqualWithAlpha	call site: 10316	/src/leptonica/src/compare.c:218

Runtime coverage analysis

Covered functions

180

Functions that are reachable but not covered

1911

Reachable functions

2090

Percentage of reachable functions covered

8.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/morphapp_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	22
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	3
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	30
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	19
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/morphapp.c	13
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/boxbasic.c	19
/src/leptonica/src/stack.c	6
/src/leptonica/src/pixabasic.c	14
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/ptabasic.c	7
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/scale2.c	25
/src/leptonica/src/scale1.c	29
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	5
/src/leptonica/src/grayquant.c	7
/src/leptonica/src/seedfill.c	5
/src/leptonica/src/queue.c	6
/src/leptonica/src/sel1.c	13
/src/leptonica/src/morph.c	19
/src/leptonica/src/graymorph.c	2
/src/leptonica/src/morphseq.c	3
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	19
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/numafunc1.c	2
/src/leptonica/src/compare.c	5

Fuzzer: jpegiostub_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	63	45.0%
gold	[1:9]	4	2.85%
yellow	[10:29]	6	4.28%
greenyellow	[30:49]	2	1.42%
lawngreen	50+	65	46.4%
All colors	140	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7	7	1 : View List ['returnErrorInt']	7	7	pixcmapAddRGBA	call site: 00089	/src/leptonica/src/colormap.c:450
7	7	1 : View List ['returnErrorInt']	7	7	pixSetWidth	call site: 00029	/src/leptonica/src/pix1.c:1007
7	7	1 : View List ['returnErrorInt']	7	7	pixSetHeight	call site: 00033	/src/leptonica/src/pix1.c:1033
7	7	1 : View List ['returnErrorInt']	7	7	pixSetDepth	call site: 00036	/src/leptonica/src/pix1.c:1059
7	7	1 : View List ['returnErrorInt']	7	7	pixSetSpp	call site: 00041	/src/leptonica/src/pix1.c:1172
0	47	2 : View List ['pixDestroy', 'returnErrorPtr']	0	47	pixCreateNoInit	call site: 00065	/src/leptonica/src/pix1.c:355
0	7	1 : View List ['returnErrorPtr']	0	7	pixcmapDeserializeFromMemory	call site: 00082	/src/leptonica/src/colormap.c:2134
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreate	call site: 00061	/src/leptonica/src/pix1.c:321
0	7	1 : View List ['returnErrorPtr']	0	7	pixCreateHeader	call site: 00026	/src/leptonica/src/pix1.c:542
0	5	1 : View List ['lept_stderr']	0	5	pixcmapDestroy	call site: 00057	/src/leptonica/src/colormap.c:276
0	0	None	14	140	pixcmapIsValid	call site: 00096	/src/leptonica/src/colormap.c:314
0	0	None	14	94	pixGetMaxColorIndex	call site: 00109	/src/leptonica/src/pix4.c:2379

Runtime coverage analysis

Covered functions

40

Functions that are reachable but not covered

3

Reachable functions

45

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/jpegiostub_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	4
/src/leptonica/src/spixio.c	2
/src/leptonica/src/pix1.c	23
/src/leptonica/src/colormap.c	5
/src/leptonica/src/pix2.c	1
/src/leptonica/src/pix4.c	1
/src/leptonica/src/pix3.c	1
/src/leptonica/src/jpegio.c	1

Fuzzer: boxfunc5_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9290	99.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	12	0.12%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	1	0.01%
All colors	9304	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	177	6 : View List ['boxaAddBox', '__isoc99_fscanf', 'boxCreate', 'boxaCreate', 'boxaDestroy', 'lept_stderr']	172	219	boxaReadStream	call site: 00015	/src/leptonica/src/boxbasic.c:2028
0	7	1 : View List ['returnErrorPtr']	0	7	boxaReadMem	call site: 00008	/src/leptonica/src/boxbasic.c:2071
0	7	1 : View List ['returnErrorPtr']	0	7	fopenReadFromMemory	call site: 00010	/src/leptonica/src/utils2.c:1960
0	0	None	174	228	boxaReadStream	call site: 00013	/src/leptonica/src/boxbasic.c:2025
0	0	None	2	157	boxaReadMem	call site: 00004	/src/leptonica/src/boxbasic.c:2069
0	0	None	2	9	fopenReadFromMemory	call site: 00008	/src/leptonica/src/utils2.c:1956
0	0	None	0	0	leptSetStderrHandler	call site: 00002	/src/leptonica/src/utils1.c:353
0	0	None	0	0	lept_stderr	call site: 00007	/src/leptonica/src/utils1.c:386

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

1948

Reachable functions

1959

Percentage of reachable functions covered

0.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/boxfunc5_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/boxbasic.c	26
/src/leptonica/src/utils2.c	27
/src/leptonica/src/boxfunc5.c	13
/src/leptonica/src/boxfunc1.c	3
/src/leptonica/src/pixabasic.c	15
/src/leptonica/src/numabasic.c	11
/src/leptonica/src/sarray1.c	10
/src/leptonica/src/bytearray.c	7
/src/leptonica/src/gplot.c	7
/src/leptonica/src/readfile.c	5
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/pix1.c	46
/src/leptonica/src/colormap.c	21
/src/leptonica/src/pix2.c	22
/src/leptonica/src/pix4.c	2
/src/leptonica/src/pix3.c	2
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	16
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/spixio.c	6
/src/leptonica/src/numafunc1.c	15
/src/leptonica/src/ptra.c	10
/src/leptonica/src/boxfunc2.c	3
/src/leptonica/src/pixafunc2.c	2
/src/leptonica/src/pixafunc1.c	5
/src/leptonica/src/scale1.c	26
/src/leptonica/src/scale2.c	1
/src/leptonica/src/enhance.c	6
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	4
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	3
/src/leptonica/src/boxfunc4.c	2
/src/leptonica/src/writefile.c	4
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	3
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	3
/src/leptonica/src/dnabasic.c	8
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	24
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/blend.c	2
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc2.c	2

Fuzzer: adaptmap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9765	92.4%
gold	[1:9]	3	0.02%
yellow	[10:29]	10	0.09%
greenyellow	[30:49]	6	0.05%
lawngreen	50+	774	7.33%
All colors	10558	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11832	11832	2 : View List ['pixaDestroy', 'pixaConvertToPdf']	11832	11846	pixMorphSequence	call site: 09046	/src/leptonica/src/morphseq.c:243
8994	8994	2 : View List ['fclose', 'pixReadStream']	8994	9001	pixRead	call site: 00136	/src/leptonica/src/readfile.c:197
4638	6640	3 : View List ['pixSmoothConnectedRegions', 'pixScaleBySampling', 'pixDestroy']	4638	6730	pixGetBackgroundRGBMap	call site: 10089	/src/leptonica/src/adaptmap.c:1222
4638	4678	2 : View List ['pixSmoothConnectedRegions', 'pixDestroy']	4638	4768	pixGetBackgroundRGBMapMorph	call site: 09974	/src/leptonica/src/adaptmap.c:1441
3689	3689	3 : View List ['pixScale', 'pixAnd', 'pixConvertTo8']	5235	5932	pixGetBackgroundGrayMapMorph	call site: 09854	/src/leptonica/src/adaptmap.c:1298
3478	3478	2 : View List ['pixGetRGBComponent', 'pixCreateRGBImage']	3478	5174	pixBlockconv	call site: 09747	/src/leptonica/src/convolve.c:167
2955	2955	2 : View List ['pixScale', 'pixConvertTo8']	9795	18675	pixGetBackgroundRGBMapMorph	call site: 09926	/src/leptonica/src/adaptmap.c:1382
1906	1906	1 : View List ['pixScaleAndTransferAlpha']	1906	1906	pixScaleBySamplingWithShift	call site: 09411	/src/leptonica/src/scale1.c:1385
1546	3548	3 : View List ['pixSmoothConnectedRegions', 'pixScaleBySampling', 'pixDestroy']	1546	3578	pixGetBackgroundGrayMap	call site: 09382	/src/leptonica/src/adaptmap.c:1033
1546	1546	1 : View List ['pixSmoothConnectedRegions']	1546	1616	pixGetBackgroundGrayMapMorph	call site: 09874	/src/leptonica/src/adaptmap.c:1319
1145	1145	1 : View List ['pixShiftAndTransferAlpha']	1145	1145	pixRemoveBorderGeneral	call site: 04817	/src/leptonica/src/pix2.c:2038
734	1518	3 : View List ['pixRasterop', 'pixAnd', 'pixDestroy']	734	1518	pixCombineMasked	call site: 10416	/src/leptonica/src/pix3.c:411

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

1909

Reachable functions

2075

Percentage of reachable functions covered

8.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/leptonica/prog/fuzzing/adaptmap_fuzzer.cc	1
/src/leptonica/prog/fuzzing/leptfuzz.h	2
/src/leptonica/src/utils1.c	15
/src/leptonica/src/spixio.c	6
/src/leptonica/src/pix1.c	47
/src/leptonica/src/colormap.c	24
/src/leptonica/src/pix2.c	29
/src/leptonica/src/pix4.c	7
/src/leptonica/src/pix3.c	9
/src/leptonica/src/readfile.c	5
/src/leptonica/src/utils2.c	30
/src/leptonica/src/tiffio.c	19
/src/libtiff/libtiff/tif_warning.c	2
/src/libtiff/libtiff/tif_error.c	4
/src/libtiff/libtiff/tif_open.c	11
/src/libtiff/libtiff/tif_unix.c	17
/src/libtiff/libtiff/tif_compress.c	2
/src/libtiff/libtiff/tif_swab.c	9
/src/libtiff/libtiff/tif_dir.c	13
/src/libtiff/libtiff/tif_dirinfo.c	12
/src/libtiff/libtiff/tif_aux.c	12
/src/libtiff/libtiff/tif_dirread.c	115
/src/libtiff/libtiff/tif_hash_set.c	13
/src/libtiff/libtiff/tif_codec.c	1
/src/libtiff/libtiff/tif_strip.c	6
/src/libtiff/libtiff/tif_tile.c	5
/src/libtiff/libtiff/tif_write.c	7
/src/libtiff/libtiff/tif_close.c	3
/src/libtiff/libtiff/tif_flush.c	3
/src/libtiff/libtiff/tif_dirwrite.c	69
/src/leptonica/src/bmpio.c	4
/src/leptonica/src/bbuffer.c	6
/src/leptonica/src/rotateorth.c	6
/src/leptonica/src/pixconv.c	22
/src/leptonica/src/rop.c	1
/src/leptonica/src/roplow.c	9
/src/leptonica/src/jpegio.c	9
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jdapimin.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jdmarker.c	3
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdatasrc.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/jutils.c	2
/src/libjpeg-turbo/src/jdapistd.c	3
/src/libjpeg-turbo/src/jquant1.c	8
/src/libjpeg-turbo/src/jquant2.c	3
/src/libjpeg-turbo/src/jdmerge.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/jdcolor.c	5
/src/libjpeg-turbo/src/jdsample.c	3
/src/libjpeg-turbo/src/jdpostct.c	3
/src/libjpeg-turbo/src/jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/jddiffct.c	3
/src/libjpeg-turbo/src/jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/jdcoefct.c	2
/src/libjpeg-turbo/src/jdmainct.c	4
/src/leptonica/src/pngio.c	2
/src/libpng/pngread.c	12
/src/libpng/png.c	32
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	22
/src/libpng/pngrio.c	2
/src/zlib/inflate.c	9
/src/libpng/pngrutil.c	23
/src/zlib/crc32.c	5
/src/libpng/pngset.c	12
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15
/src/zlib/adler32.c	2
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/libpng/pngget.c	13
/src/libtiff/libtiff/tif_read.c	11
/src/libtiff/libtiff/tif_jpeg.c	6
/src/libtiff/libtiff/tif_getimage.c	19
/src/libtiff/libtiff/tif_color.c	3
/src/leptonica/src/pnmio.c	8
/src/leptonica/src/gifiostub.c	2
/src/leptonica/src/jp2kiostub.c	3
/src/leptonica/src/webpio.c	4
/work/include/webp/decode.h	1
/src/libwebp/src/dec/webp_dec.c	16
/src/libwebp/src/dec/../../src/utils/utils.h	5
/src/libwebp/src/dec/vp8l_dec.c	57
/src/libwebp/src/dec/vp8_dec.c	21
/src/libwebp/src/utils/bit_reader_utils.c	10
/src/libwebp/src/utils/../../src/utils/bit_reader_utils.h	2
/src/libwebp/src/dec/../../src/webp/decode.h	3
/src/libwebp/src/dec/buffer_dec.c	7
/src/libwebp/src/dec/../../src/dec/vp8_dec.h	1
/src/libwebp/src/dec/io_dec.c	1
/src/libwebp/src/utils/utils.c	5
/src/libwebp/src/utils/../../src/utils/utils.h	3
/src/libwebp/src/utils/thread_utils.c	1
/src/libwebp/src/dec/tree_dec.c	4
/src/libwebp/src/utils/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/utils/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dec/quant_dec.c	2
/src/libwebp/src/dec/../../src/utils/bit_reader_inl_utils.h	2
/src/libwebp/src/dec/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/utils/rescaler_utils.c	4
/src/libwebp/src/dec/frame_dec.c	20
/src/libwebp/src/utils/random_utils.c	1
/src/libwebp/src/dsp/dec.c	2
/src/libwebp/src/dsp/dec_clip_tables.c	1
/src/libwebp/src/dsp/dec_sse2.c	1
/src/libwebp/src/dsp/dec_sse41.c	1
/src/libwebp/src/dec/../../src/utils/random_utils.h	1
/src/libwebp/src/dec/alpha_dec.c	7
/src/libwebp/src/dsp/filters.c	2
/src/libwebp/src/dsp/filters_sse2.c	1
/src/libwebp/src/dsp/lossless.c	15
/src/libwebp/src/dsp/lossless_sse2.c	1
/src/libwebp/src/dsp/lossless_sse41.c	1
/src/libwebp/src/dec/../../src/dsp/lossless_common.h	1
/src/libwebp/src/utils/color_cache_utils.c	3
/src/libwebp/src/dec/../../src/utils/bit_reader_utils.h	4
/src/libwebp/src/dec/../../src/utils/color_cache_utils.h	3
/src/libwebp/src/utils/huffman_utils.c	9
/src/libwebp/src/dsp/alpha_processing.c	3
/src/libwebp/src/dsp/alpha_processing_sse2.c	1
/src/libwebp/src/dsp/alpha_processing_sse41.c	1
/src/libwebp/src/dsp/../../src/dsp/lossless_common.h	7
/src/libwebp/src/utils/quant_levels_dec_utils.c	9
/src/libwebp/src/dsp/rescaler.c	4
/src/libwebp/src/dsp/rescaler_sse2.c	1
/src/libwebp/src/dsp/yuv.c	2
/src/libwebp/src/dsp/yuv_sse2.c	1
/src/libwebp/src/dsp/yuv_sse41.c	1
/src/libwebp/src/utils/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dec/../../src/utils/rescaler_utils.h	2
/src/libwebp/src/dsp/../../src/utils/endian_inl_utils.h	1
/src/libwebp/src/dsp/../../src/utils/utils.h	1
/src/leptonica/src/adaptmap.c	24
/src/leptonica/src/grayquant.c	4
/src/leptonica/src/morphseq.c	2
/src/leptonica/src/sarray1.c	11
/src/leptonica/src/pixabasic.c	8
/src/leptonica/src/boxbasic.c	18
/src/leptonica/src/morph.c	11
/src/leptonica/src/sel1.c	7
/src/leptonica/src/binreduce.c	3
/src/leptonica/src/scale2.c	19
/src/leptonica/src/binexpand.c	5
/src/leptonica/src/scale1.c	30
/src/leptonica/src/enhance.c	9
/src/leptonica/src/fpix1.c	7
/src/leptonica/src/convolve.c	5
/src/leptonica/src/pixacc.c	8
/src/leptonica/src/pixarith.c	4
/src/leptonica/src/writefile.c	6
/src/leptonica/src/blend.c	2
/src/leptonica/src/pixafunc2.c	1
/src/leptonica/src/numabasic.c	21
/src/leptonica/src/bytearray.c	10
/src/libjpeg-turbo/src/jcapimin.c	5
/src/libjpeg-turbo/src/jdatadst.c	1
/src/libjpeg-turbo/src/jcparam.c	11
/src/libjpeg-turbo/src/jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/jccolor.c	3
/src/libjpeg-turbo/src/jcsample.c	3
/src/libjpeg-turbo/src/jcprepct.c	4
/src/libjpeg-turbo/src/jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/jcdiffct.c	3
/src/libjpeg-turbo/src/jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/jccoefct.c	2
/src/libjpeg-turbo/src/jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/libpng/pngwrite.c	14
/src/libpng/pngwio.c	3
/src/zlib/deflate.c	16
/src/libpng/pngwutil.c	53
/src/zlib/trees.c	20
/src/libpng/pngwtran.c	5
/src/leptonica/src/psio2.c	5
/src/libwebp/src/enc/picture_enc.c	14
/src/libwebp/src/enc/../../src/webp/encode.h	3
/src/libwebp/src/enc/config_enc.c	2
/src/libwebp/src/enc/webp_enc.c	12
/src/libwebp/src/enc/picture_csp_enc.c	23
/src/libwebp/sharpyuv/sharpyuv.c	20
/src/libwebp/sharpyuv/sharpyuv_dsp.c	1
/src/libwebp/sharpyuv/sharpyuv_sse2.c	1
/src/libwebp/sharpyuv/sharpyuv_gamma.c	32
/src/libwebp/sharpyuv/sharpyuv_csp.c	1
/src/libwebp/src/enc/../../src/dsp/yuv.h	4
/src/libwebp/src/enc/../../src/utils/random_utils.h	2
/src/libwebp/src/enc/picture_tools_enc.c	6
/src/libwebp/src/dsp/enc.c	4
/src/libwebp/src/dsp/enc_sse2.c	1
/src/libwebp/src/dsp/enc_sse41.c	1
/src/libwebp/src/enc/tree_enc.c	7
/src/libwebp/src/dsp/cost.c	2
/src/libwebp/src/dsp/cost_sse2.c	1
/src/libwebp/src/enc/alpha_enc.c	12
/src/libwebp/src/enc/token_enc.c	8
/src/libwebp/src/enc/analysis_enc.c	9
/src/libwebp/src/enc/iterator_enc.c	23
/src/libwebp/src/utils/quant_levels_utils.c	1
/src/libwebp/src/utils/filters_utils.c	2
/src/libwebp/src/utils/bit_writer_utils.c	17
/src/libwebp/src/enc/vp8l_enc.c	18
/src/libwebp/src/dsp/lossless_enc.c	4
/src/libwebp/src/dsp/lossless_enc_sse2.c	1
/src/libwebp/src/dsp/lossless_enc_sse41.c	1
/src/libwebp/src/enc/backward_references_enc.c	5
/src/libwebp/src/utils/palette.c	2
/src/libwebp/src/utils/../../src/utils/color_cache_utils.h	1
/src/libwebp/src/enc/../../src/dsp/lossless_common.h	4
/src/libwebp/src/enc/histogram_enc.c	2
/src/libwebp/src/enc/picture_rescale_enc.c	4
/src/libwebp/src/enc/../../src/utils/bit_writer_utils.h	5
/src/libwebp/src/enc/frame_enc.c	30
/src/libwebp/src/enc/syntax_enc.c	15
/src/libwebp/src/enc/quant_enc.c	36
/src/libwebp/src/enc/filter_enc.c	7
/src/libwebp/src/enc/../../src/enc/cost_enc.h	3
/src/libwebp/src/enc/cost_enc.c	7
/src/libwebp/src/enc/../../src/dsp/quant.h	2
/src/libwebp/src/enc/../../src/enc/vp8i_enc.h	1
/src/libwebp/src/dsp/ssim.c	2
/src/libwebp/src/dsp/ssim_sse2.c	1
/src/libwebp/src/enc/../../src/utils/utils.h	3
/src/libwebp/src/dsp/upsampling.c	3
/src/libwebp/src/dsp/upsampling_sse2.c	1
/src/libwebp/src/dsp/upsampling_sse41.c	1
/src/leptonica/src/pdfio1.c	5
/src/leptonica/src/colorcontent.c	1
/src/leptonica/src/dnafunc1.c	4
/src/leptonica/src/dnabasic.c	17
/src/leptonica/src/hashmap.c	4
/src/leptonica/src/pdfio2.c	28
/src/leptonica/src/encoding.c	2
/src/leptonica/src/jp2kheader.c	5
/src/leptonica/src/zlibmem.c	1
/src/leptonica/src/ptra.c	9
/src/leptonica/src/ptabasic.c	6
/src/leptonica/src/numafunc1.c	3
/src/leptonica/src/conncomp.c	10
/src/leptonica/src/stack.c	6
/src/leptonica/src/pix5.c	1
/src/leptonica/src/boxfunc1.c	1
/src/leptonica/src/paintcmap.c	1
/src/leptonica/src/graymorph.c	3
/src/leptonica/src/numafunc2.c	1
/src/leptonica/src/edge.c	2
/src/leptonica/src/seedfill.c	2