High level conclusions

Fuzzers reach 85.15% of cyclomatic complexity.

Fuzzers reach 81.32% of all functions.

Fuzzers reach 82.38% code coverage.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.583% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 16.66% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

688 / 846

Cyclomatic complexity statically reachable by fuzzers

7128 / 8371

Runtime code coverage of functions

697 / 846

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	11	100.%
All colors	11	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

10

Reachable functions

12

Percentage of reachable functions covered

16.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	91	14.6%
gold	[1:9]	22	3.53%
yellow	[10:29]	19	3.04%
greenyellow	[30:49]	26	4.17%
lawngreen	50+	465	74.6%
All colors	623	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00616	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_str	call site: 00604	/src/libdwarf/src/lib/libdwarf/dwarf_stringsection.c:75
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

27

Reachable functions

192

Percentage of reachable functions covered

85.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	817	35.1%
gold	[1:9]	176	7.56%
yellow	[10:29]	163	7.00%
greenyellow	[30:49]	70	3.00%
lawngreen	50+	1100	47.2%
All colors	2326	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00954	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
616	2406	8 : View List ['read_uword_de', 'malloc', '_dwarf_decode_line_string_form', '_dwarf_report_bad_lnct', '_dwarf_decode_line_udata_form', 'IssueExpError', '_dwarf_error_string', 'free']	616	2936	_dwarf_read_line_table_header	call site: 01994	/src/libdwarf/src/lib/libdwarf/dwarf_line_table_reader_common.h:1060
183	278	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	183	709	_dwarf_extract_string_offset_via_str_offsets	call site: 01471	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1800
91	91	1 : View List ['dwarf_object_detector_path_dSYM']	99	6666	dwarf_init_path_dl	call site: 00033	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:222
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 01682	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:589
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00666	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	325	3 : View List ['dwarf_get_xu_hash_entry', 'memcmp', 'dwarf_get_xu_section_offset']	2	325	_dwarf_search_fission_for_offset	call site: 01079	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:815
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00102	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00090	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00092	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462

Runtime coverage analysis

Covered functions

370

Functions that are reachable but not covered

74

Reachable functions

418

Percentage of reachable functions covered

82.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	16
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_util.c	22
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_die_deliv.c	31
src/lib/libdwarf/dwarf_query.c	25
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	22
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	25
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	388	51.4%
gold	[1:9]	84	11.1%
yellow	[10:29]	20	2.65%
greenyellow	[30:49]	6	0.79%
lawngreen	50+	256	33.9%
All colors	754	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
177	177	4 : View List ['_dwarf_construct_linkedto_path', 'dwarfstring_strlen', 'dwarfstring_string', 'strdup']	177	187	dwarf_gnu_debuglink	call site: 00629	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:1015
112	223	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	112	223	dwarf_get_xu_index_header	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:377
57	168	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	57	168	_dwarf_extract_buildid	call site: 00619	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:917
53	53	1 : View List ['resize_table']	56	56	_tsearch_inner	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:458
43	43	1 : View List ['dwarfstring_append_printf_s']	155	266	dwarf_get_xu_index_header	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:354
27	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	27	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
11	11	2 : View List ['generic_rel_from_rela32', 'generic_rel_from_rel32']	11	33	_dwarf_elf_load_a_relx_batch	call site: 00151	/src/libdwarf/src/lib/libdwarf/dwarf_elf_load_headers.c:1612
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00747	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462

Runtime coverage analysis

Covered functions

140

Functions that are reachable but not covered

85

Reachable functions

211

Percentage of reachable functions covered

59.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	808	41.7%
gold	[1:9]	142	7.33%
yellow	[10:29]	96	4.95%
greenyellow	[30:49]	69	3.56%
lawngreen	50+	822	42.4%
All colors	1937	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1517	1517	1 : View List ['cook_loclists_contents']	1517	1623	dwarf_get_loclist_c	call site: 01763	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1729
1515	1515	1 : View List ['dwarf_offdie_b']	1515	1515	_dwarf_internal_find_die_given_sig8	call site: 01166	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:210
1511	1511	1 : View List ['cook_gnu_loclist_contents']	1511	1617	dwarf_get_loclist_c	call site: 01696	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1704
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00728	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
684	1115	6 : View List ['build_array_of_lle', 'dwarfstring_append_printf_u', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	684	1115	_dwarf_loclists_fill_in_lle_head	call site: 01792	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1189
684	844	2 : View List ['_dwarf_which_loclists_context', 'build_array_of_lle']	684	1275	_dwarf_loclists_fill_in_lle_head	call site: 01765	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1162
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
318	948	8 : View List ['dwarf_dealloc_error', 'dwarfstring_append_printf_u', 'dw_read_str_index_val_itself', 'dwarfstring_destructor', '_dwarf_trial_read_dwarf_five_hdr', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	318	948	_dwarf_extract_string_offset_via_str_offsets	call site: 01259	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1758
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00796	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
194	194	1 : View List ['_dwarf_get_loclist_lle_count_dwo']	384	1318	_dwarf_original_loclist_build	call site: 01473	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1057
175	175	1 : View List ['transform_xu_to_dfp']	175	175	dwarf_get_debugfission_for_key	call site: 00806	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:995
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01165	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649

Runtime coverage analysis

Covered functions

310

Functions that are reachable but not covered

80

Reachable functions

365

Percentage of reachable functions covered

78.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	13
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	30
src/lib/libdwarf/dwarf_query.c	23
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	23
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	520	31.9%
gold	[1:9]	116	7.12%
yellow	[10:29]	64	3.93%
greenyellow	[30:49]	58	3.56%
lawngreen	50+	869	53.4%
All colors	1627	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00728	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
318	948	8 : View List ['dwarf_dealloc_error', 'dwarfstring_append_printf_u', 'dw_read_str_index_val_itself', 'dwarfstring_destructor', '_dwarf_trial_read_dwarf_five_hdr', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	318	948	_dwarf_extract_string_offset_via_str_offsets	call site: 01259	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1758
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00796	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 01453	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:589
32	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	32	296	_dwarf_internal_global_formref_b	call site: 01164	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
21	21	1 : View List ['block_means_locexpr']	21	21	dwarf_get_form_class	call site: 01620	/src/libdwarf/src/lib/libdwarf/dwarf_query.c:1906
16	42	4 : View List ['strlen', '_dwarf_safe_strcpy', 'dwarf_insert_harmless_error', 'dwarf_errmsg']	16	137	_dwarf_load_die_containing_section	call site: 00709	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1646
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00367	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	8	389	dwarf_object_init_b	call site: 00497	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
4	1508	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	2984	dwarf_offdie_b	call site: 01181	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3014
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00449	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

54

Reachable functions

348

Percentage of reachable functions covered

84.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	136	18.7%
gold	[1:9]	42	5.78%
yellow	[10:29]	45	6.19%
greenyellow	[30:49]	23	3.16%
lawngreen	50+	480	66.1%
All colors	726	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00686	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	223	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	0	223	dwarf_get_rnglist_rle	call site: 00696	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:893
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00502	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

33

Reachable functions

198

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	9
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	94	15.1%
gold	[1:9]	24	3.87%
yellow	[10:29]	23	3.71%
greenyellow	[30:49]	19	3.06%
lawngreen	50+	459	74.1%
All colors	619	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00613	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00495	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1150

Runtime coverage analysis

Covered functions

184

Functions that are reachable but not covered

28

Reachable functions

190

Percentage of reachable functions covered

85.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	15.8%
gold	[1:9]	58	7.39%
yellow	[10:29]	52	6.63%
greenyellow	[30:49]	32	4.08%
lawngreen	50+	518	66.0%
All colors	784	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00777	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	104	1 : View List ['_dwarf_error_string']	0	104	dwarf_load_rnglists	call site: 00610	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:543
0	17	1 : View List ['dwarfstring_append']	0	130	_dwarf_internal_read_rnglists_header	call site: 00621	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:256
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00496	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1150

Runtime coverage analysis

Covered functions

211

Functions that are reachable but not covered

27

Reachable functions

213

Percentage of reachable functions covered

87.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	418	29.2%
gold	[1:9]	117	8.19%
yellow	[10:29]	78	5.46%
greenyellow	[30:49]	48	3.36%
lawngreen	50+	766	53.6%
All colors	1427	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1515	1515	1 : View List ['dwarf_offdie_b']	1515	1515	_dwarf_internal_find_die_given_sig8	call site: 01166	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:210
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00728	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01165	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
24	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	24	296	_dwarf_internal_global_formref_b	call site: 01164	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00367	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00449	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 01421	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00522	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00590	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462

Runtime coverage analysis

Covered functions

285

Functions that are reachable but not covered

51

Reachable functions

312

Percentage of reachable functions covered

83.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	29
src/lib/libdwarf/dwarf_query.c	14
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	17
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	486	33.9%
gold	[1:9]	99	6.92%
yellow	[10:29]	77	5.38%
greenyellow	[30:49]	47	3.28%
lawngreen	50+	721	50.4%
All colors	1430	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1515	1515	1 : View List ['dwarf_offdie_b']	1515	1515	_dwarf_internal_find_die_given_sig8	call site: 01166	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:210
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00728	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
348	348	2 : View List ['transform_xu_to_dfp', '_dwarf_search_fission_for_key']	348	348	dwarf_get_debugfission_for_key	call site: 00802	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:989
318	948	8 : View List ['dwarf_dealloc_error', 'dwarfstring_append_printf_u', 'dw_read_str_index_val_itself', 'dwarfstring_destructor', '_dwarf_trial_read_dwarf_five_hdr', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	318	948	_dwarf_extract_string_offset_via_str_offsets	call site: 01259	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1758
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01165	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
24	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	24	296	_dwarf_internal_global_formref_b	call site: 01164	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00367	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
2	2	1 : View List ['_dwarf_get_dwp_extra_offset']	2	2134	finish_up_cu_context_from_cudie	call site: 00794	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1453
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00449	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093

Runtime coverage analysis

Covered functions

271

Functions that are reachable but not covered

65

Reachable functions

313

Percentage of reachable functions covered

79.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	29
src/lib/libdwarf/dwarf_query.c	14
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	17
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1013	97.7%
gold	[1:9]	22	2.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.09%
All colors	1036	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3788	4619	10 : View List ['_dwarf_load_debug_types', 'dwarf_get_cu_die_offset_given_cu_header_offset_b', 'dwarf_get_debugfission_for_key', '_dwarf_file_has_debug_fission_index', '_dwarf_error', 'dwarf_offdie_b', 'strcmp', '_dwarf_load_debug_info', '_dwarf_get_dwp_extra_offset', 'dwarf_dealloc']	3788	4619	dwarf_die_from_hash_signature	call site: 00006	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1967
1743	1951	5 : View List ['dwarf_addr_form_is_indexed', '_dwarf_calculate_info_section_end_ptr', '_dwarf_look_in_local_and_tied', '_dwarf_error_string', 'generate_form_error']	1743	1951	dwarf_formaddr	call site: 00870	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1264
1025	1025	5 : View List ['_dwarf_load_debug_types', 'transform_xu_to_dfp', '_dwarf_search_fission_for_key', '_dwarf_get_xuhdr', '_dwarf_load_debug_info']	1025	1129	dwarf_get_debugfission_for_key	call site: 00217	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:963
59	59	1 : View List ['_dwarf_get_alloc']	59	59	_dwarf_error_string	call site: 00023	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:181
29	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	88	88	_dwarf_error_string	call site: 00007	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
0	0	None	189	189	dwarf_finish	call site: 00971	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:430
0	0	None	121	121	dwarf_dealloc	call site: 00090	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:808
0	0	None	0	314	get_attr_dbg	call site: 00665	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:112
0	0	None	0	0	dwarf_errmsg_by_number	call site: 00029	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:212

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

186

Reachable functions

197

Percentage of reachable functions covered

5.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	28
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_init_finish.c	3
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_xu_index.c	10
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	14
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	17
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_elfread.c	1
src/lib/libdwarf/dwarf_machoread.c	1
src/lib/libdwarf/dwarf_peread.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	251	23.3%
gold	[1:9]	62	5.76%
yellow	[10:29]	51	4.74%
greenyellow	[30:49]	15	1.39%
lawngreen	50+	696	64.7%
All colors	1075	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
116	116	1 : View List ['get_hash_value_number']	116	1188	dwarf_dnames_name	call site: 00910	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1511
53	53	1 : View List ['resize_table']	53	56	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:458
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:523
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 01068	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	168	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	168	_dwarf_internal_read_rnglists_header	call site: 00676	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:408
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_dnames_entrypool	call site: 00944	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1672

Runtime coverage analysis

Covered functions

248

Functions that are reachable but not covered

33

Reachable functions

257

Percentage of reachable functions covered

87.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	88	14.2%
gold	[1:9]	26	4.21%
yellow	[10:29]	15	2.43%
greenyellow	[30:49]	34	5.51%
lawngreen	50+	454	73.5%
All colors	617	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00202	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00370	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00452	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00610	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00525	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00593	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00183	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00423	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00497	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1150

Runtime coverage analysis

Covered functions

183

Functions that are reachable but not covered

29

Reachable functions

191

Percentage of reachable functions covered

84.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	15.9%
gold	[1:9]	37	5.58%
yellow	[10:29]	31	4.67%
greenyellow	[30:49]	34	5.12%
lawngreen	50+	455	68.6%
All colors	663	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00603	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00502	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00181	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493

Runtime coverage analysis

Covered functions

182

Functions that are reachable but not covered

34

Reachable functions

193

Percentage of reachable functions covered

82.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	230	18.9%
gold	[1:9]	45	3.71%
yellow	[10:29]	33	2.72%
greenyellow	[30:49]	37	3.05%
lawngreen	50+	867	71.5%
All colors	1212	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00370	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	112	2 : View List ['_dwarf_error_string', '_dwarf_skip_leb128']	8	218	_dwarf_get_gcc_eh_augmentation	call site: 00688	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1862
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00452	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 01206	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00525	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00593	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	316	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarf_dealloc', 'dwarfstring_string']	0	319	_dwarf_exec_frame_instr	call site: 01028	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1649
0	199	2 : View List ['_dwarf_error', 'dwarf_dealloc']	0	199	_dwarf_create_cie_from_after_start	call site: 00724	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1013
0	199	2 : View List ['_dwarf_error', 'dwarf_dealloc']	0	199	_dwarf_create_fde_from_after_start	call site: 00774	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1250
0	106	1 : View List ['_dwarf_error']	0	204	_dwarf_get_fde_list_internal	call site: 00782	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:565
0	106	1 : View List ['_dwarf_error']	0	108	dwarf_get_fde_info_for_reg3_b	call site: 00822	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:2371

Runtime coverage analysis

Covered functions

268

Functions that are reachable but not covered

31

Reachable functions

268

Percentage of reachable functions covered

88.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	35
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	552	29.2%
gold	[1:9]	169	8.96%
yellow	[10:29]	145	7.69%
greenyellow	[30:49]	68	3.60%
lawngreen	50+	951	50.4%
All colors	1885	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00728	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
183	278	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	183	709	_dwarf_extract_string_offset_via_str_offsets	call site: 01267	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1800
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00367	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00449	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 01878	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00522	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00590	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	1508	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	2984	dwarf_offdie_b	call site: 01181	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3014
0	1416	5 : View List ['_dwarf_decode_line_string_form', '_dwarf_error', '_dwarf_report_bad_lnct', '_dwarf_decode_line_udata_form', '_dwarf_error_string']	0	1416	_dwarf_read_line_table_header	call site: 01663	/src/libdwarf/src/lib/libdwarf/dwarf_line_table_reader_common.h:1179
0	448	9 : View List ['dwarfstring_append_printf_u', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarfstring_append', '_dwarf_check_string_valid', 'dwarfstring_constructor', 'dwarfstring_append_printf_s', '_dwarf_error_string', 'dwarf_get_FORM_name']	0	448	_dwarf_extract_local_debug_str_string_given_offset	call site: 01299	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1897

Runtime coverage analysis

Covered functions

342

Functions that are reachable but not covered

54

Reachable functions

365

Percentage of reachable functions covered

85.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	14
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	30
src/lib/libdwarf/dwarf_query.c	16
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	11
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	16.0%
gold	[1:9]	26	4.25%
yellow	[10:29]	16	2.61%
greenyellow	[30:49]	36	5.89%
lawngreen	50+	435	71.1%
All colors	611	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00604	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00502	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106

Runtime coverage analysis

Covered functions

177

Functions that are reachable but not covered

32

Reachable functions

188

Percentage of reachable functions covered

82.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	610	38.1%
gold	[1:9]	116	7.24%
yellow	[10:29]	100	6.25%
greenyellow	[30:49]	32	2.0%
lawngreen	50+	742	46.3%
All colors	1600	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1515	1515	1 : View List ['dwarf_offdie_b']	1515	1515	_dwarf_internal_find_die_given_sig8	call site: 01167	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:210
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
1175	1653	6 : View List ['_dwarf_create_fde_from_after_start', '_dwarf_create_cie_from_after_start', '_dwarf_read_cie_fde_prefix', '_dwarf_validate_register_numbers', '_dwarf_error', 'dwarf_dealloc']	1175	1653	dwarf_get_fde_for_die	call site: 01462	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1894
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00874	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
318	948	8 : View List ['dwarf_dealloc_error', 'dwarfstring_append_printf_u', 'dw_read_str_index_val_itself', 'dwarfstring_destructor', '_dwarf_trial_read_dwarf_five_hdr', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	318	948	_dwarf_extract_string_offset_via_str_offsets	call site: 01260	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1758
245	340	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	245	340	load_xu_str_offsets_into_cucontext	call site: 01405	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:125
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00797	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01166	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
24	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	24	296	_dwarf_internal_global_formref_b	call site: 01165	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123

Runtime coverage analysis

Covered functions

290

Functions that are reachable but not covered

65

Reachable functions

328

Percentage of reachable functions covered

80.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	29
src/lib/libdwarf/dwarf_query.c	17
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	16.1%
gold	[1:9]	69	8.64%
yellow	[10:29]	29	3.63%
greenyellow	[30:49]	30	3.75%
lawngreen	50+	541	67.7%
All colors	798	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00791	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	205	2 : View List ['free_aranges_chain', '_dwarf_error']	0	205	dwarf_get_aranges	call site: 00768	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:444
0	205	2 : View List ['free_aranges_chain', '_dwarf_error']	0	205	_dwarf_get_aranges_list	call site: 00764	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:380
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_arange_info_b	call site: 00772	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:701
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

28

Reachable functions

211

Percentage of reachable functions covered

86.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	17.0%
gold	[1:9]	33	4.71%
yellow	[10:29]	29	4.14%
greenyellow	[30:49]	40	5.71%
lawngreen	50+	479	68.4%
All colors	700	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 00622	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:589
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00694	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	95	1 : View List ['dwarf_dealloc_error']	0	253	string_offsets_example	call site: 00685	/src/libdwarf/fuzz/fuzz_str_offsets.c:112

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

27

Reachable functions

204

Percentage of reachable functions covered

86.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	15.5%
gold	[1:9]	45	6.53%
yellow	[10:29]	15	2.17%
greenyellow	[30:49]	31	4.49%
lawngreen	50+	491	71.2%
All colors	689	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00682	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00496	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1150
0	8	1 : View List ['_dwarf_error_destructor']	0	8	dwarf_dealloc	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:903

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

26

Reachable functions

199

Percentage of reachable functions covered

86.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	777	33.0%
gold	[1:9]	169	7.18%
yellow	[10:29]	117	4.97%
greenyellow	[30:49]	67	2.84%
lawngreen	50+	1222	51.9%
All colors	2352	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
616	2406	8 : View List ['read_uword_de', 'malloc', '_dwarf_decode_line_string_form', '_dwarf_report_bad_lnct', '_dwarf_decode_line_udata_form', 'IssueExpError', '_dwarf_error_string', 'free']	616	2936	_dwarf_read_line_table_header	call site: 01634	/src/libdwarf/src/lib/libdwarf/dwarf_line_table_reader_common.h:1060
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00874	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00797	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
183	278	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	183	709	_dwarf_extract_string_offset_via_str_offsets	call site: 01268	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1800
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:523
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 02345	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	1508	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	2984	dwarf_offdie_b	call site: 01182	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3014

Runtime coverage analysis

Covered functions

352

Functions that are reachable but not covered

57

Reachable functions

384

Percentage of reachable functions covered

85.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	22
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	30
src/lib/libdwarf/dwarf_query.c	16
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	36
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	16.2%
gold	[1:9]	27	4.41%
yellow	[10:29]	20	3.27%
greenyellow	[30:49]	24	3.92%
lawngreen	50+	441	72.1%
All colors	611	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00605	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00502	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106

Runtime coverage analysis

Covered functions

177

Functions that are reachable but not covered

33

Reachable functions

189

Percentage of reachable functions covered

82.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	146	17.5%
gold	[1:9]	17	2.04%
yellow	[10:29]	20	2.40%
greenyellow	[30:49]	10	1.20%
lawngreen	50+	639	76.8%
All colors	832	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
139	1434	7 : View List ['dwarf_gnu_debuglink', 'match_buildid', 'dwarf_crc32', '_dwarf_get_suppress_debuglink_crc', 'dwarf_finish', 'dwarfstring_append', 'free']	139	1719	_dwarf_debuglink_finder_newpath	call site: 00357	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:669
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00666	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	67	2 : View List ['dwarf_object_detector_fd', 'close']	4	67	dwarf_object_detector_path_dSYM	call site: 00040	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:576
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00102	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00090	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	dwarf_object_detector_path_b	call site: 00386	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:892
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00092	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	168	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	168	_dwarf_extract_buildid	call site: 00219	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:917
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00154	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00715	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395

Runtime coverage analysis

Covered functions

217

Functions that are reachable but not covered

32

Reachable functions

227

Percentage of reachable functions covered

85.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	16
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	3

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	463	32.1%
gold	[1:9]	124	8.61%
yellow	[10:29]	84	5.83%
greenyellow	[30:49]	48	3.33%
lawngreen	50+	720	50.0%
All colors	1439	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
351	357	2 : View List ['dwarfstring_constructor', '_dwarf_next_die_info_ptr']	351	3229	_dwarf_siblingof_internal	call site: 00874	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2529
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00797	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
183	278	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	183	709	_dwarf_extract_string_offset_via_str_offsets	call site: 01268	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1800
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01166	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649
32	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	32	296	_dwarf_internal_global_formref_b	call site: 01165	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	42	4 : View List ['strlen', '_dwarf_safe_strcpy', 'dwarf_insert_harmless_error', 'dwarf_errmsg']	16	137	_dwarf_load_die_containing_section	call site: 00710	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1646
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	8	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
4	1508	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	2984	dwarf_offdie_b	call site: 01182	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3014

Runtime coverage analysis

Covered functions

281

Functions that are reachable but not covered

57

Reachable functions

315

Percentage of reachable functions covered

81.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	29
src/lib/libdwarf/dwarf_query.c	15
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	17
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	449	30.8%
gold	[1:9]	105	7.21%
yellow	[10:29]	103	7.07%
greenyellow	[30:49]	42	2.88%
lawngreen	50+	757	51.9%
All colors	1456	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1515	1515	1 : View List ['dwarf_offdie_b']	1515	1515	_dwarf_internal_find_die_given_sig8	call site: 01170	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:210
1510	1510	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1510	1605	_dwarf_next_cu_header_internal	call site: 00732	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1902
212	212	1 : View List ['_dwarf_get_debugfission_for_offset']	212	316	fill_in_dwp_offsets_if_present	call site: 00800	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:528
183	278	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	183	709	_dwarf_extract_string_offset_via_str_offsets	call site: 01271	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1800
124	322	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	124	322	find_sig8_target_as_global_offset	call site: 01169	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:649
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
24	296	7 : View List ['dwarf_errmsg', 'dwarf_dealloc_error', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_string', 'dwarfstring_destructor']	24	296	_dwarf_internal_global_formref_b	call site: 01168	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:912
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:123
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 01445	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241

Runtime coverage analysis

Covered functions

284

Functions that are reachable but not covered

55

Reachable functions

315

Percentage of reachable functions covered

82.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	18
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	5
src/lib/libdwarf/dwarf_loclists.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	15
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	30
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	1
src/lib/libdwarf/dwarf_form.c	17
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_names.c	1
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	323	38.0%
gold	[1:9]	23	2.70%
yellow	[10:29]	14	1.64%
greenyellow	[30:49]	17	2.0%
lawngreen	50+	473	55.6%
All colors	850	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
91	91	1 : View List ['dwarf_object_detector_path_dSYM']	99	6666	dwarf_init_path_dl	call site: 00033	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:222
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00666	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00071	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00102	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00090	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00092	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00733	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106

Runtime coverage analysis

Covered functions

186

Functions that are reachable but not covered

68

Reachable functions

232

Percentage of reachable functions covered

70.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	16
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	3

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	132	16.8%
gold	[1:9]	34	4.34%
yellow	[10:29]	35	4.47%
greenyellow	[30:49]	37	4.73%
lawngreen	50+	544	69.5%
All colors	782	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00201	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00703	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	106	1 : View List ['_dwarf_error']	0	106	_dwarf_load_section	call site: 00182	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1493
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_get_xu_index_header	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:395
0	104	1 : View List ['_dwarf_error_string']	0	104	dwarf_dnames_sizes	call site: 00711	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:935
0	104	1 : View List ['_dwarf_error_string']	0	104	dwarf_dnames_offsets	call site: 00717	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:996

Runtime coverage analysis

Covered functions

212

Functions that are reachable but not covered

27

Reachable functions

215

Percentage of reachable functions covered

87.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	109	15.6%
gold	[1:9]	28	4.02%
yellow	[10:29]	37	5.32%
greenyellow	[30:49]	43	6.18%
lawngreen	50+	478	68.7%
All colors	695	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00369	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	65	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00451	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00688	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00524	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	152	1 : View List ['emit_one_value_msg']	0	152	dwarf_gdbindex_culist_entry	call site: 00642	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:415
0	152	1 : View List ['emit_one_value_msg']	0	152	dwarf_gdbindex_types_culist_entry	call site: 00648	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:492
0	152	1 : View List ['emit_one_value_msg']	0	152	dwarf_gdbindex_addressarea_entry	call site: 00656	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:571
0	152	1 : View List ['emit_one_value_msg']	0	152	dwarf_gdbindex_symboltable_entry	call site: 00663	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:649
0	106	1 : View List ['_dwarf_error']	0	106	dwarf_gdbindex_addressarea_entry	call site: 00655	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:561

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

25

Reachable functions

211

Percentage of reachable functions covered

88.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	16.0%
gold	[1:9]	26	4.26%
yellow	[10:29]	29	4.75%
greenyellow	[30:49]	28	4.59%
lawngreen	50+	429	70.3%
All colors	610	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
53	53	1 : View List ['apply_rela_entries']	53	53	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:498
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00200	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:844
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00368	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:324
10	120	4 : View List ['dwarf_errno', 'dwarfstring_append', 'dwarf_dealloc', 'dwarf_errmsg']	10	389	dwarf_object_init_b	call site: 00498	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1089
10	29	5 : View List ['_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append', 'dwarfstring_constructor', 'calloc', '_dwarf_add_to_static_err_list']	10	88	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:120
8	8	1 : View List ['_dwarf_error_destructor']	8	55	dwarf_dealloc	call site: 00434	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:900
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	370	_dwarf_free_all_of_one_debug	call site: 00450	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1093
2	2	1 : View List ['close']	2	162	dwarf_finish	call site: 00603	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:458
2	2	1 : View List ['close']	2	2	_dwarf_destruct_macho_access	call site: 00523	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:241
2	2	1 : View List ['close']	2	2	_dwarf_destruct_pe_access	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:462
0	111	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	111	dwarf_object_init_b	call site: 00502	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1106

Runtime coverage analysis

Covered functions

176

Functions that are reachable but not covered

33

Reachable functions

188

Percentage of reachable functions covered

82.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	6
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_memcpy_swap.c	2
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	40
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	1
src/lib/libdwarf/dwarf_loclists.c	1
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	15
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13