High level conclusions

Fuzzers reach 83.10% of cyclomatic complexity.

Fuzzers reach 80.0% of all functions.

Fuzzers reach 81.0% code coverage.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.164% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 16.66% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

720 / 900

Cyclomatic complexity statically reachable by fuzzers

7654 / 9210

Runtime code coverage of functions

729 / 900

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	17.0%
gold	[1:9]	25	3.87%
yellow	[10:29]	9	1.39%
greenyellow	[30:49]	34	5.27%
lawngreen	50+	467	72.4%
All colors	645	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

33

Reachable functions

204

Percentage of reachable functions covered

83.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	18.8%
gold	[1:9]	11	1.25%
yellow	[10:29]	20	2.28%
greenyellow	[30:49]	11	1.25%
lawngreen	50+	667	76.3%
All colors	874	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	1476	7 : View List ['match_buildid', 'dwarfstring_append', '_dwarf_get_suppress_debuglink_crc', 'dwarf_gnu_debuglink', 'dwarf_crc32', 'dwarf_finish', 'free']	156	1791	_dwarf_debuglink_finder_newpath	call site: 00352	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:746
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00086	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	171	5 : View List ['dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append_printf_u', '_dwarf_error_string', 'dwarfstring_constructor']	0	171	_dwarf_extract_buildid	call site: 00210	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:914
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00734	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	85	2 : View List ['_dwarf_object_detector_fd_a', '_dwarf_closer']	0	85	dwarf_object_detector_path_dSYM	call site: 00048	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:648
0	17	1 : View List ['dwarfstring_append']	0	33	transform_leading_windowsletter	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:207
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00156	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1340

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

36

Reachable functions

241

Percentage of reachable functions covered

85.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	145	18.3%
gold	[1:9]	40	5.05%
yellow	[10:29]	25	3.16%
greenyellow	[30:49]	18	2.27%
lawngreen	50+	563	71.1%
All colors	791	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
35	35	1 : View List ['transform_leading_windowsletter']	35	426	_dwarf_construct_linkedto_path	call site: 00698	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:654
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	2 : View List ['strlen', 'strdup']	4	4	dwarf_gnu_debuglink	call site: 00635	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:988
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

41

Reachable functions

225

Percentage of reachable functions covered

81.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	510	31.3%
gold	[1:9]	145	8.90%
yellow	[10:29]	92	5.64%
greenyellow	[30:49]	78	4.78%
lawngreen	50+	804	49.3%
All colors	1629	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01345	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278

Runtime coverage analysis

Covered functions

311

Functions that are reachable but not covered

56

Reachable functions

338

Percentage of reachable functions covered

83.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.7%
gold	[1:9]	10	1.56%
yellow	[10:29]	23	3.59%
greenyellow	[30:49]	33	5.16%
lawngreen	50+	453	70.8%
All colors	639	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

39

Reachable functions

203

Percentage of reachable functions covered

80.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	18.4%
gold	[1:9]	18	2.83%
yellow	[10:29]	22	3.47%
greenyellow	[30:49]	24	3.78%
lawngreen	50+	453	71.4%
All colors	634	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

39

Reachable functions

202

Percentage of reachable functions covered

80.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	265	19.6%
gold	[1:9]	38	2.81%
yellow	[10:29]	58	4.30%
greenyellow	[30:49]	18	1.33%
lawngreen	50+	969	71.8%
All colors	1348	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	115	2 : View List ['_dwarf_error_string', '_dwarf_skip_leb128']	8	224	_dwarf_get_gcc_eh_augmentation	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1986
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	329	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarf_dealloc', '_dwarf_error_string', 'dwarfstring_constructor']	0	332	_dwarf_exec_frame_instr	call site: 01154	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1867
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_cie_from_after_start	call site: 00766	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1057
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_fde_from_after_start	call site: 00832	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1360

Runtime coverage analysis

Covered functions

282

Functions that are reachable but not covered

36

Reachable functions

285

Percentage of reachable functions covered

87.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	37
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	504	30.3%
gold	[1:9]	147	8.83%
yellow	[10:29]	103	6.19%
greenyellow	[30:49]	58	3.48%
lawngreen	50+	851	51.1%
All colors	1663	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01349	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00872	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01622	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01440	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01348	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01347	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565

Runtime coverage analysis

Covered functions

315

Functions that are reachable but not covered

56

Reachable functions

342

Percentage of reachable functions covered

83.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	512	31.1%
gold	[1:9]	129	7.83%
yellow	[10:29]	106	6.43%
greenyellow	[30:49]	73	4.43%
lawngreen	50+	826	50.1%
All colors	1646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	1998	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	3939	dwarf_offdie_b	call site: 01361	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3284
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565

Runtime coverage analysis

Covered functions

314

Functions that are reachable but not covered

57

Reachable functions

342

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	18.4%
gold	[1:9]	29	3.99%
yellow	[10:29]	34	4.68%
greenyellow	[30:49]	31	4.26%
lawngreen	50+	498	68.5%
All colors	726	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 00652	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:647
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

32

Reachable functions

217

Percentage of reachable functions covered

85.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	20.6%
gold	[1:9]	52	6.71%
yellow	[10:29]	41	5.29%
greenyellow	[30:49]	24	3.10%
lawngreen	50+	497	64.2%
All colors	774	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	226	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_string', '_dwarf_error_string', 'dwarfstring_constructor']	0	226	dwarf_get_rnglist_rle	call site: 00737	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:1023
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00521	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

37

Reachable functions

213

Percentage of reachable functions covered

82.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	620	28.9%
gold	[1:9]	213	9.93%
yellow	[10:29]	96	4.47%
greenyellow	[30:49]	76	3.54%
lawngreen	50+	1140	53.1%
All colors	2145	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	1998	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	3939	dwarf_offdie_b	call site: 01361	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3284

Runtime coverage analysis

Covered functions

368

Functions that are reachable but not covered

56

Reachable functions

391

Percentage of reachable functions covered

85.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	20
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	18.4%
gold	[1:9]	22	3.46%
yellow	[10:29]	15	2.36%
greenyellow	[30:49]	31	4.88%
lawngreen	50+	450	70.8%
All colors	635	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

38

Reachable functions

202

Percentage of reachable functions covered

81.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	17.5%
gold	[1:9]	23	3.20%
yellow	[10:29]	39	5.43%
greenyellow	[30:49]	27	3.76%
lawngreen	50+	503	70.0%
All colors	718	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_culist_entry	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:420
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_types_culist_entry	call site: 00679	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:497

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

31

Reachable functions

224

Percentage of reachable functions covered

86.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	33.8%
gold	[1:9]	176	9.68%
yellow	[10:29]	123	6.76%
greenyellow	[30:49]	57	3.13%
lawngreen	50+	846	46.5%
All colors	1817	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01345	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
346	474	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_constructor', '_dwarf_read_encoded_ptr']	346	2943	_dwarf_create_fde_from_after_start	call site: 01676	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1115
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
109	109	1 : View List ['regerror']	109	109	_dwarf_validate_register_numbers	call site: 01658	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:169
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

59

Reachable functions

353

Percentage of reachable functions covered

83.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	19
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	551	33.6%
gold	[1:9]	128	7.82%
yellow	[10:29]	107	6.54%
greenyellow	[30:49]	56	3.42%
lawngreen	50+	794	48.5%
All colors	1636	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01345	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278

Runtime coverage analysis

Covered functions

305

Functions that are reachable but not covered

63

Reachable functions

339

Percentage of reachable functions covered

81.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	16.4%
gold	[1:9]	21	3.25%
yellow	[10:29]	14	2.16%
greenyellow	[30:49]	35	5.41%
lawngreen	50+	470	72.7%
All colors	646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

32

Reachable functions

205

Percentage of reachable functions covered

84.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	506	30.5%
gold	[1:9]	161	9.71%
yellow	[10:29]	116	6.99%
greenyellow	[30:49]	28	1.68%
lawngreen	50+	847	51.0%
All colors	1658	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01349	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00872	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01622	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01440	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01348	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01347	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565

Runtime coverage analysis

Covered functions

314

Functions that are reachable but not covered

56

Reachable functions

341

Percentage of reachable functions covered

83.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	16.2%
gold	[1:9]	22	3.43%
yellow	[10:29]	12	1.87%
greenyellow	[30:49]	30	4.68%
lawngreen	50+	472	73.7%
All colors	640	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

34

Reachable functions

204

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	350	39.0%
gold	[1:9]	20	2.23%
yellow	[10:29]	17	1.89%
greenyellow	[30:49]	29	3.23%
lawngreen	50+	480	53.5%
All colors	896	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00035	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:622
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00082	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	10	426	dwarf_object_init_b	call site: 00749	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00756	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_sec_group_map	call site: 00888	/src/libdwarf/src/lib/libdwarf/dwarf_groups.c:294

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

72

Reachable functions

245

Percentage of reachable functions covered

70.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	100.%
All colors	12	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	dwarf_basic_crc32	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_crc.c:137

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

10

Reachable functions

12

Percentage of reachable functions covered

16.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	18.2%
gold	[1:9]	35	4.32%
yellow	[10:29]	42	5.18%
greenyellow	[30:49]	21	2.59%
lawngreen	50+	564	69.6%
All colors	810	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	111	1 : View List ['dwarf_dealloc_dnames']	0	218	dwarf_dnames_header	call site: 00727	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:836
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

228

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1161	97.9%
gold	[1:9]	23	1.94%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1185	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2240	2454	5 : View List ['dwarf_addr_form_is_indexed', '_dwarf_look_in_local_and_tied', 'generate_form_error', '_dwarf_error_string', '_dwarf_calculate_info_section_end_ptr']	2240	2454	dwarf_formaddr	call site: 01017	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1310
62	62	1 : View List ['_dwarf_get_alloc']	62	62	_dwarf_error_string	call site: 00024	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:193
29	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	91	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
0	0	None	126	126	dwarf_dealloc	call site: 00054	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:960
0	0	None	0	323	get_attr_dbg	call site: 00740	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:113
0	0	None	0	0	dwarf_errmsg_by_number	call site: 00030	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:225

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

202

Reachable functions

213

Percentage of reachable functions covered

5.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	526	28.5%
gold	[1:9]	150	8.13%
yellow	[10:29]	99	5.36%
greenyellow	[30:49]	43	2.33%
lawngreen	50+	1027	55.6%
All colors	1845	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 01653	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	1998	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	3939	dwarf_offdie_b	call site: 01361	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3284
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

353

Functions that are reachable but not covered

49

Reachable functions

372

Percentage of reachable functions covered

86.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	36
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	22
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	478	29.2%
gold	[1:9]	122	7.46%
yellow	[10:29]	141	8.62%
greenyellow	[30:49]	48	2.93%
lawngreen	50+	845	51.7%
All colors	1634	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01345	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01618	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_destructor', 'dwarfstring_string', 'dwarfstring_append', 'dwarfstring_constructor_fixed', '_dwarf_error_string', 'dwarf_dealloc_error']	24	309	_dwarf_internal_global_formref_b	call site: 01343	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

317

Functions that are reachable but not covered

51

Reachable functions

339

Percentage of reachable functions covered

84.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	18
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	18.5%
gold	[1:9]	50	7.18%
yellow	[10:29]	20	2.87%
greenyellow	[30:49]	33	4.74%
lawngreen	50+	464	66.6%
All colors	696	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_dealloc_error', 'dwarf_errmsg', 'dwarf_errno', 'dwarfstring_append']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1055
10	29	5 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'calloc', 'dwarfstring_append', 'dwarfstring_constructor']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00521	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

39

Reachable functions

206

Percentage of reachable functions covered

81.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	821	38.3%
gold	[1:9]	189	8.83%
yellow	[10:29]	96	4.48%
greenyellow	[30:49]	89	4.15%
lawngreen	50+	945	44.1%
All colors	2140	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2014	2014	1 : View List ['cook_loclists_contents']	2014	2133	dwarf_get_loclist_c	call site: 02016	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1793
2008	2008	1 : View List ['cook_gnu_loclist_contents']	2008	2127	dwarf_get_loclist_c	call site: 01948	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1768
1994	1994	1 : View List ['_dwarf_search_for_signature']	2908	3990	_dwarf_loclists_fill_in_lle_head	call site: 02017	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1238
1994	1994	1 : View List ['dwarf_offdie_b']	1994	1994	_dwarf_internal_find_die_given_sig8	call site: 01345	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
914	1033	6 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'build_array_of_lle', 'dwarfstring_string', '_dwarf_which_loclists_context', 'dwarfstring_constructor']	914	1675	_dwarf_loclists_fill_in_lle_head	call site: 02020	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1276
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
202	202	1 : View List ['_dwarf_get_loclist_lle_count_dwo']	400	1407	_dwarf_original_loclist_build	call site: 01669	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1065
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01344	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_string', '_dwarf_lkind_name', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor']	70	203	_dwarf_loc_block_sanity_check	call site: 01759	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:458
70	203	6 : View List ['dwarfstring_destructor', 'dwarfstring_string', '_dwarf_lkind_name', 'dwarfstring_append', '_dwarf_error_string', 'dwarfstring_constructor']	70	203	_dwarf_loc_block_sanity_check	call site: 01770	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:473
66	66	3 : View List ['strlen', '_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	198	dwarfstring_append_printf_i	call site: 01893	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:523

Runtime coverage analysis

Covered functions

339

Functions that are reachable but not covered

80

Reachable functions

388

Percentage of reachable functions covered

79.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	26
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	885	33.6%
gold	[1:9]	178	6.76%
yellow	[10:29]	94	3.57%
greenyellow	[30:49]	89	3.38%
lawngreen	50+	1384	52.6%
All colors	2630	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 01109	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00035	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
64	64	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	66	162	dwarfstring_append_printf_i	call site: 01916	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00086	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 01031	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2123
0	333	3 : View List ['dwarf_dealloc_die', '_dwarf_error_string', 'local_dealloc_cu_context']	0	333	_dwarf_create_a_new_cu_context_record_on_list	call site: 01106	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1892
0	330	2 : View List ['_dwarf_error_string', '_dwarf_check_string_valid']	0	330	_dwarf_decode_line_string_form	call site: 02183	/src/libdwarf/src/lib/libdwarf/dwarf_line.c:2390

Runtime coverage analysis

Covered functions

401

Functions that are reachable but not covered

75

Reachable functions

445

Percentage of reachable functions covered

83.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	18.4%
gold	[1:9]	66	7.84%
yellow	[10:29]	32	3.80%
greenyellow	[30:49]	40	4.75%
lawngreen	50+	548	65.1%
All colors	841	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	107	2 : View List ['free', '_dwarf_error_string']	0	107	_dwarf_internal_read_rnglists_header	call site: 00716	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:555
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00244	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1340

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

228

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	767	28.6%
gold	[1:9]	201	7.49%
yellow	[10:29]	122	4.55%
greenyellow	[30:49]	64	2.38%
lawngreen	50+	1527	56.9%
All colors	2681	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01436	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
8	8	2 : View List ['_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	1998	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	3939	dwarf_offdie_b	call site: 01361	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3284
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 00790	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2123
0	440	5 : View List ['dwarfstring_append_printf_u', 'dwarfstring_destructor', 'dwarfstring_string', '_dwarf_error_string', 'dwarfstring_constructor']	0	440	_dwarf_extract_address_from_debug_addr	call site: 01554	/src/libdwarf/src/lib/libdwarf/dwarf_query.c:999

Runtime coverage analysis

Covered functions

387

Functions that are reachable but not covered

55

Reachable functions

411

Percentage of reachable functions covered

86.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	20
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	122	17.0%
gold	[1:9]	44	6.16%
yellow	[10:29]	12	1.68%
greenyellow	[30:49]	32	4.48%
lawngreen	50+	504	70.5%
All colors	714	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00244	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1340

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

31

Reachable functions

212

Percentage of reachable functions covered

85.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	147	17.3%
gold	[1:9]	78	9.18%
yellow	[10:29]	31	3.65%
greenyellow	[30:49]	36	4.24%
lawngreen	50+	557	65.6%
All colors	849	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_zeros', '_dwarfstring_append_spaces']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	dwarf_get_aranges	call site: 00827	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:441
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	_dwarf_get_aranges_list	call site: 00821	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:381
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_arange_info_b	call site: 00831	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:698

Runtime coverage analysis

Covered functions

222

Functions that are reachable but not covered

31

Reachable functions

224

Percentage of reachable functions covered

86.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	262	22.7%
gold	[1:9]	55	4.77%
yellow	[10:29]	48	4.16%
greenyellow	[30:49]	50	4.33%
lawngreen	50+	738	64.0%
All colors	1153	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
119	119	1 : View List ['get_hash_value_number']	119	1223	dwarf_dnames_name	call site: 00982	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1506
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:647
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1076
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:858
4	6	2 : View List ['dwarf_errmsg_by_number', 'fflush']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:565
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1281
0	111	1 : View List ['dwarf_dealloc_dnames']	0	218	dwarf_dnames_header	call site: 00971	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:836
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_dnames_entrypool	call site: 01016	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1667

Runtime coverage analysis

Covered functions

262

Functions that are reachable but not covered

35

Reachable functions

271

Percentage of reachable functions covered

87.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1