High level conclusions

Fuzzers reach 84.06% of cyclomatic complexity.

Fuzzers reach 81.01% of all functions.

Fuzzers reach 77.74% code coverage.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.188% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 16.66% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

717 / 885

Cyclomatic complexity statically reachable by fuzzers

7536 / 8965

Runtime code coverage of functions

688 / 885

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	11	100.%
All colors	11	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	dwarf_basic_crc32	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_crc.c:136

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

10

Reachable functions

12

Percentage of reachable functions covered

16.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	16.6%
gold	[1:9]	20	3.35%
yellow	[10:29]	23	3.85%
greenyellow	[30:49]	22	3.69%
lawngreen	50+	432	72.4%
All colors	596	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00340	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00318	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00404	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00470	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00589	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00537	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00577	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00420	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00477	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

36

Reachable functions

197

Percentage of reachable functions covered

81.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	128	16.7%
gold	[1:9]	24	3.14%
yellow	[10:29]	32	4.18%
greenyellow	[30:49]	32	4.18%
lawngreen	50+	548	71.7%
All colors	764	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00340	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00318	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00407	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00690	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00537	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00577	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00420	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['dwarf_dealloc_dnames']	0	216	dwarf_dnames_header	call site: 00680	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:835
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00390	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	107	1 : View List ['_dwarf_error_string']	0	107	dwarf_dnames_sizes	call site: 00698	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:929
0	107	1 : View List ['_dwarf_error_string']	0	107	dwarf_dnames_offsets	call site: 00703	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:990

Runtime coverage analysis

Covered functions

220

Functions that are reachable but not covered

29

Reachable functions

224

Percentage of reachable functions covered

87.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	16.0%
gold	[1:9]	68	8.46%
yellow	[10:29]	27	3.36%
greenyellow	[30:49]	24	2.98%
lawngreen	50+	555	69.1%
All colors	803	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00796	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	216	2 : View List ['_dwarf_error', 'free_aranges_chain']	0	216	dwarf_get_aranges	call site: 00773	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:440
0	216	2 : View List ['_dwarf_error', 'free_aranges_chain']	0	216	_dwarf_get_aranges_list	call site: 00770	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:380
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_arange_info_b	call site: 00777	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:697
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00391	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390

Runtime coverage analysis

Covered functions

219

Functions that are reachable but not covered

29

Reachable functions

220

Percentage of reachable functions covered

86.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	15.7%
gold	[1:9]	29	4.25%
yellow	[10:29]	20	2.93%
greenyellow	[30:49]	30	4.40%
lawngreen	50+	495	72.6%
All colors	681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00674	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_culist_entry	call site: 00628	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:419
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_types_culist_entry	call site: 00634	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:496
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_addressarea_entry	call site: 00642	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:575
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_symboltable_entry	call site: 00649	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:653

Runtime coverage analysis

Covered functions

216

Functions that are reachable but not covered

28

Reachable functions

220

Percentage of reachable functions covered

87.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	443	28.8%
gold	[1:9]	101	6.58%
yellow	[10:29]	76	4.95%
greenyellow	[30:49]	32	2.08%
lawngreen	50+	881	57.4%
All colors	1533	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01221	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00740	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01486	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00813	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01308	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01220	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01219	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01522	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497

Runtime coverage analysis

Covered functions

311

Functions that are reachable but not covered

54

Reachable functions

337

Percentage of reachable functions covered

83.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	419	27.8%
gold	[1:9]	105	6.97%
yellow	[10:29]	78	5.18%
greenyellow	[30:49]	50	3.32%
lawngreen	50+	853	56.6%
All colors	1505	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01217	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01498	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434

Runtime coverage analysis

Covered functions

314

Functions that are reachable but not covered

48

Reachable functions

334

Percentage of reachable functions covered

85.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	463	27.6%
gold	[1:9]	144	8.58%
yellow	[10:29]	65	3.87%
greenyellow	[30:49]	48	2.86%
lawngreen	50+	957	57.0%
All colors	1677	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
329	979	8 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarfstring_append_printf_u', '_dwarf_error_string', 'dwarfstring_destructor', 'dw_read_str_index_val_itself', 'dwarf_dealloc_error', 'dwarfstring_constructor', 'dwarfstring_string']	329	979	_dwarf_extract_string_offset_via_str_offsets	call site: 01295	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1811
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 01511	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:611
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	1939	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	3523	dwarf_offdie_b	call site: 01232	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3260
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01600	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434

Runtime coverage analysis

Covered functions

344

Functions that are reachable but not covered

51

Reachable functions

366

Percentage of reachable functions covered

86.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	36
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	22
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	536	32.0%
gold	[1:9]	121	7.24%
yellow	[10:29]	85	5.08%
greenyellow	[30:49]	46	2.75%
lawngreen	50+	883	52.8%
All colors	1671	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00735	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
346	474	5 : View List ['dwarfstring_append_printf_u', '_dwarf_read_encoded_ptr', 'dwarfstring_destructor', 'dwarfstring_constructor', 'dwarfstring_string']	346	2941	_dwarf_create_fde_from_after_start	call site: 01535	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1114
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01481	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00808	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01303	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
109	109	1 : View List ['regerror']	109	109	_dwarf_validate_register_numbers	call site: 01518	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:168
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01214	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00318	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00407	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969

Runtime coverage analysis

Covered functions

319

Functions that are reachable but not covered

58

Reachable functions

348

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	20
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	669	33.9%
gold	[1:9]	160	8.10%
yellow	[10:29]	76	3.85%
greenyellow	[30:49]	50	2.53%
lawngreen	50+	1018	51.5%
All colors	1973	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1948	1948	1 : View List ['cook_loclists_contents']	1948	2065	dwarf_get_loclist_c	call site: 01815	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1719
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01217	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
707	1147	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'build_array_of_lle', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	707	1147	_dwarf_loclists_fill_in_lle_head	call site: 01826	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1323
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01304	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 01611	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:454
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:469
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953

Runtime coverage analysis

Covered functions

341

Functions that are reachable but not covered

71

Reachable functions

382

Percentage of reachable functions covered

81.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	15
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	25
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	452	29.9%
gold	[1:9]	103	6.83%
yellow	[10:29]	80	5.30%
greenyellow	[30:49]	36	2.38%
lawngreen	50+	836	55.4%
All colors	1507	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01217	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01304	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01500	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497

Runtime coverage analysis

Covered functions

307

Functions that are reachable but not covered

56

Reachable functions

335

Percentage of reachable functions covered

83.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	136	18.6%
gold	[1:9]	45	6.17%
yellow	[10:29]	17	2.33%
greenyellow	[30:49]	34	4.66%
lawngreen	50+	497	68.1%
All colors	729	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00405	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00471	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00686	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	226	5 : View List ['dwarfstring_append_printf_u', '_dwarf_error_string', 'dwarfstring_destructor', 'dwarfstring_constructor', 'dwarfstring_string']	0	226	dwarf_get_rnglist_rle	call site: 00696	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:1015
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00478	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00391	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390

Runtime coverage analysis

Covered functions

202

Functions that are reachable but not covered

34

Reachable functions

208

Percentage of reachable functions covered

83.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	116	16.9%
gold	[1:9]	27	3.94%
yellow	[10:29]	17	2.48%
greenyellow	[30:49]	26	3.80%
lawngreen	50+	498	72.8%
All colors	684	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 00608	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:611
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00678	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00392	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	103	1 : View List ['dwarf_dealloc_error']	0	272	string_offsets_example	call site: 00669	/src/libdwarf/fuzz/fuzz_str_offsets.c:114

Runtime coverage analysis

Covered functions

207

Functions that are reachable but not covered

30

Reachable functions

213

Percentage of reachable functions covered

85.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	443	29.5%
gold	[1:9]	114	7.59%
yellow	[10:29]	77	5.12%
greenyellow	[30:49]	36	2.39%
lawngreen	50+	831	55.3%
All colors	1501	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01217	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01494	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267

Runtime coverage analysis

Covered functions

308

Functions that are reachable but not covered

53

Reachable functions

333

Percentage of reachable functions covered

84.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	654	26.9%
gold	[1:9]	152	6.25%
yellow	[10:29]	109	4.48%
greenyellow	[30:49]	48	1.97%
lawngreen	50+	1468	60.3%
All colors	2431	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01304	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 02424	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	1939	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	3523	dwarf_offdie_b	call site: 01232	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3260
0	532	1 : View List ['_dwarf_siblingof_internal']	0	532	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2099

Runtime coverage analysis

Covered functions

387

Functions that are reachable but not covered

48

Reachable functions

405

Percentage of reachable functions covered

88.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	22
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	20
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	93	15.3%
gold	[1:9]	11	1.81%
yellow	[10:29]	12	1.97%
greenyellow	[30:49]	30	4.94%
lawngreen	50+	461	75.9%
All colors	607	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00601	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00392	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00469	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

31

Reachable functions

199

Percentage of reachable functions covered

84.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	326	38.5%
gold	[1:9]	17	2.00%
yellow	[10:29]	17	2.00%
greenyellow	[30:49]	11	1.30%
lawngreen	50+	475	56.1%
All colors	846	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
113	113	1 : View List ['dwarf_object_detector_path_dSYM']	113	7062	dwarf_init_path_dl_a	call site: 00033	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:253
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00194	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00650	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00076	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00706	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00109	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00713	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_sec_group_map	call site: 00838	/src/libdwarf/src/lib/libdwarf/dwarf_groups.c:293
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00693	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

70

Reachable functions

241

Percentage of reachable functions covered

70.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	18
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	3

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	17.2%
gold	[1:9]	31	4.73%
yellow	[10:29]	21	3.20%
greenyellow	[30:49]	35	5.34%
lawngreen	50+	455	69.4%
All colors	655	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00340	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00318	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00404	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00470	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00589	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00537	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00577	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00420	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00477	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00390	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

37

Reachable functions

202

Percentage of reachable functions covered

81.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	246	19.0%
gold	[1:9]	29	2.24%
yellow	[10:29]	49	3.79%
greenyellow	[30:49]	17	1.31%
lawngreen	50+	950	73.5%
All colors	1291	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	115	2 : View List ['_dwarf_skip_leb128', '_dwarf_error_string']	8	224	_dwarf_get_gcc_eh_augmentation	call site: 00680	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1985
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01284	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	327	6 : View List ['dwarfstring_append_printf_u', 'dwarf_dealloc', '_dwarf_error_string', 'dwarfstring_destructor', 'dwarfstring_constructor', 'dwarfstring_string']	0	330	_dwarf_exec_frame_instr	call site: 01104	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1866
0	210	2 : View List ['_dwarf_error', 'dwarf_dealloc']	0	210	_dwarf_create_cie_from_after_start	call site: 00717	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1056
0	210	2 : View List ['_dwarf_error', 'dwarf_dealloc']	0	210	_dwarf_create_fde_from_after_start	call site: 00783	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1359
0	109	1 : View List ['_dwarf_error']	0	215	_dwarf_get_fde_list_internal	call site: 00791	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:584

Runtime coverage analysis

Covered functions

279

Functions that are reachable but not covered

34

Reachable functions

281

Percentage of reachable functions covered

87.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	36
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	14.6%
gold	[1:9]	12	1.97%
yellow	[10:29]	27	4.43%
greenyellow	[30:49]	19	3.11%
lawngreen	50+	462	75.8%
All colors	609	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00603	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00392	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00469	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

30

Reachable functions

201

Percentage of reachable functions covered

85.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	706	39.5%
gold	[1:9]	165	9.24%
yellow	[10:29]	106	5.94%
greenyellow	[30:49]	51	2.85%
lawngreen	50+	756	42.3%
All colors	1784	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1948	1948	1 : View List ['cook_loclists_contents']	1948	2065	dwarf_get_loclist_c	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1719
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00297	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
707	1147	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'build_array_of_lle', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	707	1147	_dwarf_loclists_fill_in_lle_head	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1323
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:454
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:469
15	1555	7 : View List ['dwarf_gnu_debuglink', 'dwarf_crc32', '_dwarf_get_suppress_debuglink_crc', 'match_buildid', 'dwarfstring_append', 'free', 'dwarf_finish']	15	1864	_dwarf_debuglink_finder_newpath	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:736
5	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	5	60	dwarf_dealloc	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
4	4	2 : View List ['strlen', 'strdup']	4	4	dwarf_gnu_debuglink	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:987
2	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	2	91	_dwarf_error_string	call site: 00099	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00046	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	1947	1 : View List ['dwarf_offdie_b']	0	1947	_dwarf_internal_find_die_given_sig8	call site: 00799	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
0	1939	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	3523	dwarf_offdie_b	call site: 00814	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3260

Runtime coverage analysis

Covered functions

689

Functions that are reachable but not covered

57

Reachable functions

438

Percentage of reachable functions covered

86.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	2
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_elfread.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_machoread.c	2
src/lib/libdwarf/dwarf_peread.c	1
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	10
src/lib/libdwarf/dwarf_util.c	22
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	2
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_query.c	24
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_debuglink.c	2

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	16.5%
gold	[1:9]	12	2.00%
yellow	[10:29]	28	4.68%
greenyellow	[30:49]	19	3.17%
lawngreen	50+	440	73.5%
All colors	598	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00405	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00471	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00591	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00478	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111

Runtime coverage analysis

Covered functions

186

Functions that are reachable but not covered

35

Reachable functions

197

Percentage of reachable functions covered

82.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	447	29.4%
gold	[1:9]	107	7.05%
yellow	[10:29]	73	4.81%
greenyellow	[30:49]	33	2.17%
lawngreen	50+	856	56.4%
All colors	1516	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
256	359	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	256	359	load_xu_str_offsets_into_cucontext	call site: 01482	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:132
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00809	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01304	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01216	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01215	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	1939	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	3523	dwarf_offdie_b	call site: 01232	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3260
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01505	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497

Runtime coverage analysis

Covered functions

311

Functions that are reachable but not covered

54

Reachable functions

337

Percentage of reachable functions covered

83.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	237	21.7%
gold	[1:9]	77	7.07%
yellow	[10:29]	36	3.30%
greenyellow	[30:49]	32	2.93%
lawngreen	50+	707	64.9%
All colors	1089	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
119	119	1 : View List ['get_hash_value_number']	119	1223	dwarf_dnames_name	call site: 00921	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1505
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:517
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01082	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['dwarf_dealloc_dnames']	0	216	dwarf_dnames_header	call site: 00910	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:835
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_dnames_entrypool	call site: 00955	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1666

Runtime coverage analysis

Covered functions

258

Functions that are reachable but not covered

34

Reachable functions

267

Percentage of reachable functions covered

87.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	31.4%
gold	[1:9]	158	8.06%
yellow	[10:29]	98	5.00%
greenyellow	[30:49]	68	3.47%
lawngreen	50+	1019	52.0%
All colors	1958	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1948	1948	1 : View List ['cook_loclists_contents']	1948	2065	dwarf_get_loclist_c	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1719
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00736	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
707	1147	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'build_array_of_lle', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	707	1147	_dwarf_loclists_fill_in_lle_head	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1323
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:454
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string', '_dwarf_lkind_name']	70	203	_dwarf_loc_block_sanity_check	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:469
15	1555	7 : View List ['dwarf_gnu_debuglink', 'dwarf_crc32', '_dwarf_get_suppress_debuglink_crc', 'match_buildid', 'dwarfstring_append', 'free', 'dwarf_finish']	15	1864	_dwarf_debuglink_finder_newpath	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:736
5	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	5	60	dwarf_dealloc	call site: 00405	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
4	4	2 : View List ['strlen', 'strdup']	4	4	dwarf_gnu_debuglink	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:987
2	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	2	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	1947	1 : View List ['dwarf_offdie_b']	0	1947	_dwarf_internal_find_die_given_sig8	call site: 01217	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
0	1939	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	3523	dwarf_offdie_b	call site: 01232	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3260

Runtime coverage analysis

Covered functions

689

Functions that are reachable but not covered

58

Reachable functions

386

Percentage of reachable functions covered

84.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	20
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	15.5%
gold	[1:9]	39	5.76%
yellow	[10:29]	16	2.36%
greenyellow	[30:49]	15	2.21%
lawngreen	50+	502	74.1%
All colors	677	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00670	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00392	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00469	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200
0	8	1 : View List ['_dwarf_error_destructor']	0	8	dwarf_dealloc	call site: 00406	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:951
0	0	None	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:506

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

28

Reachable functions

208

Percentage of reachable functions covered

86.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	15.5%
gold	[1:9]	55	6.98%
yellow	[10:29]	30	3.81%
greenyellow	[30:49]	40	5.08%
lawngreen	50+	540	68.6%
All colors	787	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00342	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00320	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00409	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00780	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00539	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00579	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00422	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00392	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00469	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200
0	8	1 : View List ['_dwarf_error_destructor']	0	8	dwarf_dealloc	call site: 00406	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:951
0	0	None	56	111	dwarf_dealloc	call site: 00403	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:877

Runtime coverage analysis

Covered functions

224

Functions that are reachable but not covered

29

Reachable functions

224

Percentage of reachable functions covered

87.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	146	17.6%
gold	[1:9]	11	1.33%
yellow	[10:29]	11	1.33%
greenyellow	[30:49]	7	0.84%
lawngreen	50+	651	78.8%
All colors	826	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	1555	7 : View List ['dwarf_gnu_debuglink', 'dwarf_crc32', '_dwarf_get_suppress_debuglink_crc', 'match_buildid', 'dwarfstring_append', 'free', 'dwarf_finish']	156	1864	_dwarf_debuglink_finder_newpath	call site: 00347	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:736
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00650	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00080	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00109	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	171	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_string']	0	171	_dwarf_extract_buildid	call site: 00208	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:913
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00693	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	89	2 : View List ['_dwarf_closer', 'dwarf_object_detector_fd']	0	89	dwarf_object_detector_path_dSYM	call site: 00040	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:639
0	17	1 : View List ['dwarfstring_append']	0	33	transform_leading_windowsletter	call site: 00253	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:206
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00156	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200
0	8	1 : View List ['_dwarf_error_destructor']	0	8	dwarf_dealloc	call site: 00076	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:951

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

34

Reachable functions

237

Percentage of reachable functions covered

85.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	18
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	3

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	127	17.0%
gold	[1:9]	23	3.08%
yellow	[10:29]	10	1.34%
greenyellow	[30:49]	44	5.90%
lawngreen	50+	541	72.6%
All colors	745	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
35	35	1 : View List ['transform_leading_windowsletter']	35	426	_dwarf_construct_linkedto_path	call site: 00650	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:653
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00405	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00471	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00738	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	2 : View List ['strlen', 'strdup']	4	4	dwarf_gnu_debuglink	call site: 00590	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:987
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

38

Reachable functions

220

Percentage of reachable functions covered

82.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1075	97.9%
gold	[1:9]	22	2.00%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.09%
All colors	1098	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2177	2391	5 : View List ['generate_form_error', '_dwarf_look_in_local_and_tied', '_dwarf_calculate_info_section_end_ptr', '_dwarf_error_string', 'dwarf_addr_form_is_indexed']	2177	2391	dwarf_formaddr	call site: 00922	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1305
62	62	1 : View List ['_dwarf_get_alloc']	62	62	_dwarf_error_string	call site: 00023	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:184
29	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	91	91	_dwarf_error_string	call site: 00007	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
0	0	None	126	126	dwarf_dealloc	call site: 00046	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:856
0	0	None	0	323	get_attr_dbg	call site: 00656	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:112
0	0	None	0	0	dwarf_errmsg_by_number	call site: 00029	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:215

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

201

Reachable functions

212

Percentage of reachable functions covered

5.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	10
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_elfread.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_machoread.c	2
src/lib/libdwarf/dwarf_peread.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	14.4%
gold	[1:9]	17	2.81%
yellow	[10:29]	4	0.66%
greenyellow	[30:49]	32	5.29%
lawngreen	50+	464	76.8%
All colors	604	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00343	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00321	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00410	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00597	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00540	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00580	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00423	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00393	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:390
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00470	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1200

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

32

Reachable functions

200

Percentage of reachable functions covered

84.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	17
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	16.5%
gold	[1:9]	12	2.00%
yellow	[10:29]	25	4.17%
greenyellow	[30:49]	15	2.50%
lawngreen	50+	448	74.7%
All colors	599	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:492
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00405	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:948
10	128	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc']	10	418	dwarf_object_init_b	call site: 00471	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1094
10	29	5 : View List ['dwarfstring_append', '_dwarf_add_to_static_err_list', 'calloc', 'dwarfstring_constructor', '_dwarf_special_no_dbg_error_malloc']	10	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:122
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 00592	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00578	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:434
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:479
2	2	1 : View List ['fclose']	2	394	_dwarf_free_all_of_one_debug	call site: 00421	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1141
0	114	3 : View List ['dwarfstring_destructor', '_dwarf_error_string', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00478	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1111

Runtime coverage analysis

Covered functions

186

Functions that are reachable but not covered

36

Reachable functions

198

Percentage of reachable functions covered

81.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	16
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	458	29.9%
gold	[1:9]	120	7.84%
yellow	[10:29]	78	5.10%
greenyellow	[30:49]	42	2.74%
lawngreen	50+	831	54.3%
All colors	1529	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1947	1947	1 : View List ['dwarf_offdie_b']	1947	1947	_dwarf_internal_find_die_given_sig8	call site: 01221	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:211
1940	1940	1 : View List ['_dwarf_merge_all_base_attrs_of_cu_die']	1940	2684	_dwarf_next_cu_header_internal	call site: 00740	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2083
217	217	1 : View List ['_dwarf_get_debugfission_for_offset']	217	324	fill_in_dwp_offsets_if_present	call site: 00813	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:619
186	289	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	729	_dwarf_extract_string_offset_via_str_offsets	call site: 01308	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1853
127	345	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	345	find_sig8_target_as_global_offset	call site: 01220	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:681
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00341	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:866
24	307	7 : View List ['dwarfstring_destructor', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errmsg', '_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor_fixed']	24	307	_dwarf_internal_global_formref_b	call site: 01219	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:953
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00319	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:346
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:125
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00408	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:969
4	4	1 : View List ['_dwarf_closer']	4	182	dwarf_finish	call site: 01518	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:497
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00538	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:267

Runtime coverage analysis

Covered functions

306

Functions that are reachable but not covered

58

Reachable functions

336

Percentage of reachable functions covered

82.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	8
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_setup_sections.c	3
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5